npm - @clear-capabilities/agentic-security-scanner - Versions diffs - 0.118.2 → 0.119.1 - Mend

@clear-capabilities/agentic-security-scanner 0.118.2 → 0.119.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (155) hide show

package/src/dataflow/.agentic-security/last-scan.json.sig DELETED Viewed

	@@ -1 +0,0 @@
1	- c5c255f3078afcb3abb37615903b8ab5c7f13f82bd33a5089398909530ab25e9

package/src/dataflow/.agentic-security/sbom-history/15d7c4d20f9d968ebec29445c9e9b3fc6f74e6a1.json DELETED Viewed

@@ -1,6 +0,0 @@
-{
-  "sha": "15d7c4d20f9d968ebec29445c9e9b3fc6f74e6a1",
-  "ts": "2026-05-31T15:22:34.931Z",
-  "componentCount": 0,
-  "components": []
-}

package/src/dataflow/.agentic-security/sbom-history/3852ad2aa0e50951bed0c930c29d1861aa13d048.json DELETED Viewed

@@ -1,6 +0,0 @@
-{
-  "sha": "3852ad2aa0e50951bed0c930c29d1861aa13d048",
-  "ts": "2026-05-31T18:39:51.074Z",
-  "componentCount": 0,
-  "components": []
-}

package/src/dataflow/.agentic-security/sbom-history/73166872888d9ddcbe98645af818ecc7d8917b07.json DELETED Viewed

@@ -1,6 +0,0 @@
-{
-  "sha": "73166872888d9ddcbe98645af818ecc7d8917b07",
-  "ts": "2026-05-31T15:37:46.482Z",
-  "componentCount": 0,
-  "components": []
-}

package/src/dataflow/.agentic-security/sbom-history/8869fe64035bec0152d92ece961e9369d8637076.json DELETED Viewed

@@ -1,6 +0,0 @@
-{
-  "sha": "8869fe64035bec0152d92ece961e9369d8637076",
-  "ts": "2026-05-31T13:34:26.146Z",
-  "componentCount": 0,
-  "components": []
-}

package/src/dataflow/.agentic-security/sbom-history/9c93b15e8cf3ff2ddb8cdae92371b82e178b463c.json DELETED Viewed

@@ -1,6 +0,0 @@
-{
-  "sha": "9c93b15e8cf3ff2ddb8cdae92371b82e178b463c",
-  "ts": "2026-05-31T04:45:23.979Z",
-  "componentCount": 0,
-  "components": []
-}

package/src/dataflow/.agentic-security/sbom-history/b7ac2dada4a9216ccfe8969fc57f988c83f46975.json DELETED Viewed

@@ -1,6 +0,0 @@
-{
-  "sha": "b7ac2dada4a9216ccfe8969fc57f988c83f46975",
-  "ts": "2026-05-31T05:26:44.996Z",
-  "componentCount": 0,
-  "components": []
-}

package/src/dataflow/.agentic-security/scan-history.json DELETED Viewed

@@ -1,250 +0,0 @@
-[
-  {
-    "timestamp": "2026-05-28T21:51:05.438Z",
-    "label": "scan",
-    "total": 13,
-    "critical": 0,
-    "high": 0,
-    "medium": 13,
-    "low": 0,
-    "kev": 0,
-    "ids": [
-      "ssrf-meta-hardcoded:catalog.js:538",
-      "ssrf-meta-hardcoded:exploit-prover.js:33",
-      "struct:incremental.js:203:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:204:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:209:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:220:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:223:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:50:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:51:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:68:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:69:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "toctou-fs:incremental.js:50",
-      "toctou-fs:incremental.js:68"
-    ]
-  },
-  {
-    "timestamp": "2026-05-28T21:58:02.385Z",
-    "label": "scan",
-    "total": 13,
-    "critical": 0,
-    "high": 0,
-    "medium": 13,
-    "low": 0,
-    "kev": 0,
-    "ids": [
-      "ssrf-meta-hardcoded:catalog.js:538",
-      "ssrf-meta-hardcoded:exploit-prover.js:33",
-      "struct:incremental.js:203:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:204:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:209:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:220:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:223:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:50:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:51:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:68:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:69:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "toctou-fs:incremental.js:50",
-      "toctou-fs:incremental.js:68"
-    ]
-  },
-  {
-    "timestamp": "2026-05-29T06:25:27.255Z",
-    "label": "scan",
-    "total": 17,
-    "critical": 0,
-    "high": 0,
-    "medium": 17,
-    "low": 0,
-    "kev": 0,
-    "ids": [
-      "ssrf-meta-hardcoded:catalog.js:538",
-      "ssrf-meta-hardcoded:exploit-prover.js:33",
-      "struct:ifds-precise.js:177:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:ifds-precise.js:179:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:ifds-precise.js:206:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:203:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:204:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:209:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:220:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:223:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:50:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:51:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:68:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:69:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "toctou-fs:ifds-precise.js:177",
-      "toctou-fs:incremental.js:50",
-      "toctou-fs:incremental.js:68"
-    ]
-  },
-  {
-    "timestamp": "2026-05-29T06:26:15.864Z",
-    "label": "scan",
-    "total": 17,
-    "critical": 0,
-    "high": 0,
-    "medium": 17,
-    "low": 0,
-    "kev": 0,
-    "ids": [
-      "ssrf-meta-hardcoded:catalog.js:538",
-      "ssrf-meta-hardcoded:exploit-prover.js:33",
-      "struct:ifds-precise.js:177:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:ifds-precise.js:179:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:ifds-precise.js:206:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:203:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:204:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:209:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:220:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:223:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:50:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:51:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:68:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:69:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "toctou-fs:ifds-precise.js:177",
-      "toctou-fs:incremental.js:50",
-      "toctou-fs:incremental.js:68"
-    ]
-  },
-  {
-    "timestamp": "2026-05-29T06:26:55.369Z",
-    "label": "scan",
-    "total": 23,
-    "critical": 0,
-    "high": 0,
-    "medium": 23,
-    "low": 0,
-    "kev": 0,
-    "ids": [
-      "ssrf-meta-hardcoded:catalog.js:538",
-      "ssrf-meta-hardcoded:exploit-prover.js:33",
-      "struct:cross-service-taint.js:53:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:cross-service-taint.js:55:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:cross-service-taint.js:97:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:cross-service-taint.js:98:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:ifds-precise.js:177:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:ifds-precise.js:179:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:ifds-precise.js:206:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:203:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:204:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:209:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:220:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:223:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:50:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:51:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:68:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:69:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "toctou-fs:cross-service-taint.js:53",
-      "toctou-fs:cross-service-taint.js:97",
-      "toctou-fs:ifds-precise.js:177",
-      "toctou-fs:incremental.js:50",
-      "toctou-fs:incremental.js:68"
-    ]
-  },
-  {
-    "timestamp": "2026-05-29T06:31:00.224Z",
-    "label": "scan",
-    "total": 23,
-    "critical": 0,
-    "high": 0,
-    "medium": 23,
-    "low": 0,
-    "kev": 0,
-    "ids": [
-      "ssrf-meta-hardcoded:catalog.js:538",
-      "ssrf-meta-hardcoded:exploit-prover.js:33",
-      "struct:cross-service-taint.js:53:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:cross-service-taint.js:55:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:cross-service-taint.js:97:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:cross-service-taint.js:98:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:ifds-precise.js:177:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:ifds-precise.js:179:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:ifds-precise.js:206:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:203:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:204:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:209:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:220:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:223:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:50:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:51:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:68:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:69:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "toctou-fs:cross-service-taint.js:53",
-      "toctou-fs:cross-service-taint.js:97",
-      "toctou-fs:ifds-precise.js:177",
-      "toctou-fs:incremental.js:50",
-      "toctou-fs:incremental.js:68"
-    ]
-  },
-  {
-    "timestamp": "2026-05-29T06:32:47.791Z",
-    "label": "scan",
-    "total": 23,
-    "critical": 0,
-    "high": 0,
-    "medium": 23,
-    "low": 0,
-    "kev": 0,
-    "ids": [
-      "ssrf-meta-hardcoded:catalog.js:538",
-      "ssrf-meta-hardcoded:exploit-prover.js:33",
-      "struct:cross-service-taint.js:53:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:cross-service-taint.js:55:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:cross-service-taint.js:97:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:cross-service-taint.js:98:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:ifds-precise.js:177:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:ifds-precise.js:179:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:ifds-precise.js:206:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:203:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:204:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:209:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:220:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:223:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:50:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:51:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:68:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:69:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "toctou-fs:cross-service-taint.js:53",
-      "toctou-fs:cross-service-taint.js:97",
-      "toctou-fs:ifds-precise.js:177",
-      "toctou-fs:incremental.js:50",
-      "toctou-fs:incremental.js:68"
-    ]
-  },
-  {
-    "timestamp": "2026-05-29T06:49:36.287Z",
-    "label": "scan",
-    "total": 23,
-    "critical": 0,
-    "high": 0,
-    "medium": 23,
-    "low": 0,
-    "kev": 0,
-    "ids": [
-      "ssrf-meta-hardcoded:catalog.js:538",
-      "ssrf-meta-hardcoded:exploit-prover.js:33",
-      "struct:cross-service-taint.js:53:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:cross-service-taint.js:55:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:cross-service-taint.js:97:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:cross-service-taint.js:98:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:ifds-precise.js:177:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:ifds-precise.js:179:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:ifds-precise.js:206:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:203:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:204:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:209:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:220:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:223:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:50:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:51:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:68:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:incremental.js:69:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "toctou-fs:cross-service-taint.js:53",
-      "toctou-fs:cross-service-taint.js:97",
-      "toctou-fs:ifds-precise.js:177",
-      "toctou-fs:incremental.js:50",
-      "toctou-fs:incremental.js:68"
-    ]
-  }
-]

package/src/dataflow/.agentic-security/streak.json DELETED Viewed

@@ -1,21 +0,0 @@
-{
-  "firstScanDate": "2026-05-28T21:51:05.470Z",
-  "lastScanDate": "2026-05-29T06:49:36.319Z",
-  "totalScans": 8,
-  "daysCleanCritical": 2,
-  "lastCleanDate": "2026-05-29",
-  "lastCriticalDate": null,
-  "hasEverHadCritical": false,
-  "bestDaysCleanCritical": 2,
-  "totalFindingsAtFirstScan": 17,
-  "totalFindingsAtLastScan": 30,
-  "totalFixesInferred": 0,
-  "lastGrade": "A",
-  "bestGrade": "A",
-  "launchCheckPassedAt": null,
-  "achievements": [
-    "first-scan",
-    "grade-a"
-  ],
-  "previousGrade": "A"
-}

package/src/dataflow/.agentic-security/threat-model.json DELETED Viewed

@@ -1,161 +0,0 @@
-{
-  "entities": [],
-  "boundaries": [],
-  "assets": [],
-  "threats": [
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-400",
-      "family": "dos-sync-io",
-      "severity": "medium",
-      "file": "cross-service-taint.js",
-      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
-      "finding_id": "struct:cross-service-taint.js:53:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-400",
-      "family": "dos-sync-io",
-      "severity": "medium",
-      "file": "ifds-precise.js",
-      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
-      "finding_id": "struct:ifds-precise.js:177:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-400",
-      "family": "dos-sync-io",
-      "severity": "medium",
-      "file": "incremental.js",
-      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
-      "finding_id": "struct:incremental.js:50:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "I",
-      "strideLabel": "Information Disclosure",
-      "cwe": "CWE-918",
-      "family": "ssrf",
-      "severity": "medium",
-      "file": "catalog.js",
-      "line": 547,
-      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
-      "finding_id": "ssrf-meta-hardcoded:catalog.js:547",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "E",
-      "strideLabel": "Elevation of Privilege",
-      "cwe": "CWE-918",
-      "family": "ssrf",
-      "severity": "medium",
-      "file": "catalog.js",
-      "line": 547,
-      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
-      "finding_id": "ssrf-meta-hardcoded:catalog.js:547",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-367",
-      "family": "toctou-file-existence-permission-check-b",
-      "severity": "medium",
-      "file": "cross-service-taint.js",
-      "line": 53,
-      "vuln": "TOCTOU: file existence/permission check before open",
-      "finding_id": "toctou-fs:cross-service-taint.js:53",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-367",
-      "family": "toctou-file-existence-permission-check-b",
-      "severity": "medium",
-      "file": "cross-service-taint.js",
-      "line": 97,
-      "vuln": "TOCTOU: file existence/permission check before open",
-      "finding_id": "toctou-fs:cross-service-taint.js:97",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "I",
-      "strideLabel": "Information Disclosure",
-      "cwe": "CWE-918",
-      "family": "ssrf",
-      "severity": "medium",
-      "file": "exploit-prover.js",
-      "line": 33,
-      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
-      "finding_id": "ssrf-meta-hardcoded:exploit-prover.js:33",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "E",
-      "strideLabel": "Elevation of Privilege",
-      "cwe": "CWE-918",
-      "family": "ssrf",
-      "severity": "medium",
-      "file": "exploit-prover.js",
-      "line": 33,
-      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
-      "finding_id": "ssrf-meta-hardcoded:exploit-prover.js:33",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-367",
-      "family": "toctou-file-existence-permission-check-b",
-      "severity": "medium",
-      "file": "ifds-precise.js",
-      "line": 177,
-      "vuln": "TOCTOU: file existence/permission check before open",
-      "finding_id": "toctou-fs:ifds-precise.js:177",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-367",
-      "family": "toctou-file-existence-permission-check-b",
-      "severity": "medium",
-      "file": "incremental.js",
-      "line": 50,
-      "vuln": "TOCTOU: file existence/permission check before open",
-      "finding_id": "toctou-fs:incremental.js:50",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-367",
-      "family": "toctou-file-existence-permission-check-b",
-      "severity": "medium",
-      "file": "incremental.js",
-      "line": 68,
-      "vuln": "TOCTOU: file existence/permission check before open",
-      "finding_id": "toctou-fs:incremental.js:68",
-      "affectsAsset": null,
-      "atEntity": null
-    }
-  ],
-  "attackTrees": []
-}

package/src/dataflow/.agentic-security/threat-model.md DELETED Viewed

@@ -1,43 +0,0 @@
-# Threat Model (auto-generated)
-Generated by agentic-security on 2026-05-31.
-This threat model is derived from static analysis of the current codebase and is regenerated on every scan. It is intended as a working artifact, not a finished compliance document.
-## Entities + boundaries
-```mermaid
-flowchart TB
-  subgraph External
-  end
-  subgraph Application
-  end
-```
-## Assets
-## STRIDE threats
-### Tampering (8)
-- [medium] **dos-sync-io** (CWE-400) at `cross-service-taint.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [medium] **dos-sync-io** (CWE-400) at `ifds-precise.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [medium] **dos-sync-io** (CWE-400) at `incremental.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [medium] **toctou-file-existence-permission-check-b** (CWE-367) at `cross-service-taint.js:53` — TOCTOU: file existence/permission check before open
-- [medium] **toctou-file-existence-permission-check-b** (CWE-367) at `cross-service-taint.js:97` — TOCTOU: file existence/permission check before open
-- [medium] **toctou-file-existence-permission-check-b** (CWE-367) at `ifds-precise.js:177` — TOCTOU: file existence/permission check before open
-- [medium] **toctou-file-existence-permission-check-b** (CWE-367) at `incremental.js:50` — TOCTOU: file existence/permission check before open
-- [medium] **toctou-file-existence-permission-check-b** (CWE-367) at `incremental.js:68` — TOCTOU: file existence/permission check before open
-### Information Disclosure (2)
-- [medium] **ssrf** (CWE-918) at `catalog.js:547` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [medium] **ssrf** (CWE-918) at `exploit-prover.js:33` — SSRF: explicit reference to cloud instance-metadata endpoint
-### Elevation of Privilege (2)
-- [medium] **ssrf** (CWE-918) at `catalog.js:547` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [medium] **ssrf** (CWE-918) at `exploit-prover.js:33` — SSRF: explicit reference to cloud instance-metadata endpoint
-## Attack trees

package/src/ir/.agentic-security/dpia.md DELETED Viewed

@@ -1,26 +0,0 @@
-# Data Protection Impact Assessment (DPIA)
-Generated by agentic-security scanner on 2026-05-31.
-This is an automated DPIA scaffold derived from static analysis.
-It must be reviewed and completed by a privacy officer before use.
-## Data classes identified
-## Privacy-related findings
-| Severity | File:Line | Class → Sink | Description |
-|---|---|---|---|
-## Regulatory framework mapping
-- **GDPR Art. 35** — DPIA required when processing is likely to result in high risk to data subjects.
-- **CCPA §1798.130** — Notice + access rights for collected personal information.
-## Reviewer checklist
-- [ ] Confirm each PII field's collection has a documented lawful basis
-- [ ] Confirm retention period for each class is documented
-- [ ] Confirm DSAR (data subject access request) workflow exists
-- [ ] Confirm encryption at rest + in transit for each class
-- [ ] Confirm logging of PII access for audit (where applicable)

package/src/ir/.agentic-security/exploit-bundles.json DELETED Viewed

@@ -1,77 +0,0 @@
-{
-  "struct:parser-cs.js:208:Mass_Assignment_(req.body_Direct_to_Model)": {
-    "family": "mass-assignment",
-    "exploitable": "unknown",
-    "pocs": {
-      "curl": null
-    },
-    "tests": {
-      "jest": null,
-      "pytest": null
-    },
-    "remediation": {
-      "summary": "no template for this family yet — manual review required"
-    },
-    "stub": true
-  },
-  "struct:parser-go.js:253:Mass_Assignment_(req.body_Direct_to_Model)": {
-    "family": "mass-assignment",
-    "exploitable": "unknown",
-    "pocs": {
-      "curl": null
-    },
-    "tests": {
-      "jest": null,
-      "pytest": null
-    },
-    "remediation": {
-      "summary": "no template for this family yet — manual review required"
-    },
-    "stub": true
-  },
-  "struct:parser-kt.js:207:Mass_Assignment_(req.body_Direct_to_Model)": {
-    "family": "mass-assignment",
-    "exploitable": "unknown",
-    "pocs": {
-      "curl": null
-    },
-    "tests": {
-      "jest": null,
-      "pytest": null
-    },
-    "remediation": {
-      "summary": "no template for this family yet — manual review required"
-    },
-    "stub": true
-  },
-  "struct:parser-php.js:209:Mass_Assignment_(req.body_Direct_to_Model)": {
-    "family": "mass-assignment",
-    "exploitable": "unknown",
-    "pocs": {
-      "curl": null
-    },
-    "tests": {
-      "jest": null,
-      "pytest": null
-    },
-    "remediation": {
-      "summary": "no template for this family yet — manual review required"
-    },
-    "stub": true
-  },
-  "struct:parser-rb.js:201:Mass_Assignment_(req.body_Direct_to_Model)": {
-    "family": "mass-assignment",
-    "exploitable": "unknown",
-    "pocs": {
-      "curl": null
-    },
-    "tests": {
-      "jest": null,
-      "pytest": null
-    },
-    "remediation": {
-      "summary": "no template for this family yet — manual review required"
-    },
-    "stub": true
-  }
-}