@clear-capabilities/agentic-security-scanner 0.118.2 → 0.119.1

package/src/ir/.agentic-security/last-scan.json.sig

@@ -1 +0,0 @@
-da76e96762f8d7ee6ac2ee8968d5822c14bee45de513ed9c1d60cf6f6694c261

package/src/ir/.agentic-security/sbom-history/73166872888d9ddcbe98645af818ecc7d8917b07.json

@@ -1,6 +0,0 @@
-{
-  "sha": "73166872888d9ddcbe98645af818ecc7d8917b07",
-  "ts": "2026-05-31T15:37:04.152Z",
-  "componentCount": 0,
-  "components": []
-}

package/src/ir/.agentic-security/sbom-history/b5f468a158f6a145aedd8680841c106b9809f16b.json

@@ -1,6 +0,0 @@
-{
-  "sha": "b5f468a158f6a145aedd8680841c106b9809f16b",
-  "ts": "2026-05-31T16:25:21.141Z",
-  "componentCount": 0,
-  "components": []
-}

package/src/ir/.agentic-security/scan-history.json

@@ -1,193 +0,0 @@
-[
-  {
-    "timestamp": "2026-05-28T18:59:26.541Z",
-    "label": "scan",
-    "total": 15,
-    "critical": 0,
-    "high": 5,
-    "medium": 10,
-    "low": 0,
-    "kev": 0,
-    "ids": [
-      "struct:parser-cs.js:208:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:parser-go.js:253:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:parser-kt.js:207:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:parser-php.js:209:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:parser-py-cst.js:91:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:parser-rb.js:201:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:type-stubs.js:190:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:198:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:216:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:245:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:48:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:57:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:58:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:79:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "toctou-fs:type-stubs.js:48"
-    ]
-  },
-  {
-    "timestamp": "2026-05-28T19:04:00.910Z",
-    "label": "scan",
-    "total": 15,
-    "critical": 0,
-    "high": 5,
-    "medium": 10,
-    "low": 0,
-    "kev": 0,
-    "ids": [
-      "struct:parser-cs.js:208:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:parser-go.js:253:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:parser-kt.js:207:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:parser-php.js:209:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:parser-py-cst.js:91:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:parser-rb.js:201:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:type-stubs.js:190:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:198:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:216:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:245:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:48:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:57:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:58:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:79:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "toctou-fs:type-stubs.js:48"
-    ]
-  },
-  {
-    "timestamp": "2026-05-28T19:06:14.172Z",
-    "label": "scan",
-    "total": 15,
-    "critical": 0,
-    "high": 5,
-    "medium": 10,
-    "low": 0,
-    "kev": 0,
-    "ids": [
-      "struct:parser-cs.js:208:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:parser-go.js:253:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:parser-kt.js:207:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:parser-php.js:209:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:parser-py-cst.js:91:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:parser-rb.js:201:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:type-stubs.js:190:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:198:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:216:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:245:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:48:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:57:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:58:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:79:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "toctou-fs:type-stubs.js:48"
-    ]
-  },
-  {
-    "timestamp": "2026-05-28T19:06:52.695Z",
-    "label": "scan",
-    "total": 15,
-    "critical": 0,
-    "high": 5,
-    "medium": 10,
-    "low": 0,
-    "kev": 0,
-    "ids": [
-      "struct:parser-cs.js:208:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:parser-go.js:253:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:parser-kt.js:207:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:parser-php.js:209:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:parser-py-cst.js:91:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:parser-rb.js:201:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:type-stubs.js:190:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:198:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:216:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:245:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:48:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:57:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:58:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:79:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "toctou-fs:type-stubs.js:48"
-    ]
-  },
-  {
-    "timestamp": "2026-05-28T20:16:46.839Z",
-    "label": "scan",
-    "total": 15,
-    "critical": 0,
-    "high": 5,
-    "medium": 10,
-    "low": 0,
-    "kev": 0,
-    "ids": [
-      "struct:parser-cs.js:208:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:parser-go.js:253:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:parser-kt.js:207:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:parser-php.js:209:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:parser-py-cst.js:91:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:parser-rb.js:201:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:type-stubs.js:190:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:198:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:216:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:245:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:48:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:57:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:58:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:79:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "toctou-fs:type-stubs.js:48"
-    ]
-  },
-  {
-    "timestamp": "2026-05-28T21:57:00.566Z",
-    "label": "scan",
-    "total": 16,
-    "critical": 0,
-    "high": 5,
-    "medium": 11,
-    "low": 0,
-    "kev": 0,
-    "ids": [
-      "struct:cpp-preprocessor.js:94:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:parser-cs.js:208:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:parser-go.js:253:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:parser-kt.js:207:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:parser-php.js:209:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:parser-py-cst.js:91:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:parser-rb.js:201:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:type-stubs.js:190:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:198:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:216:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:245:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:48:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:57:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:58:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:79:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "toctou-fs:type-stubs.js:48"
-    ]
-  },
-  {
-    "timestamp": "2026-05-29T06:24:38.526Z",
-    "label": "scan",
-    "total": 16,
-    "critical": 0,
-    "high": 5,
-    "medium": 11,
-    "low": 0,
-    "kev": 0,
-    "ids": [
-      "struct:cpp-preprocessor.js:94:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:parser-cs.js:208:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:parser-go.js:253:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:parser-kt.js:207:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:parser-php.js:209:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:parser-py-cst.js:91:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:parser-rb.js:201:Mass_Assignment_(req.body_Direct_to_Model)",
-      "struct:type-stubs.js:190:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:198:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:216:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:245:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:48:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:57:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:58:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "struct:type-stubs.js:79:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "toctou-fs:type-stubs.js:48"
-    ]
-  }
-]

package/src/ir/.agentic-security/streak.json

@@ -1,20 +0,0 @@
-{
-  "firstScanDate": "2026-05-28T18:59:26.568Z",
-  "lastScanDate": "2026-05-29T06:24:38.574Z",
-  "totalScans": 7,
-  "daysCleanCritical": 2,
-  "lastCleanDate": "2026-05-29",
-  "lastCriticalDate": null,
-  "hasEverHadCritical": false,
-  "bestDaysCleanCritical": 2,
-  "totalFindingsAtFirstScan": 16,
-  "totalFindingsAtLastScan": 17,
-  "totalFixesInferred": 0,
-  "lastGrade": "B",
-  "bestGrade": "B",
-  "launchCheckPassedAt": null,
-  "achievements": [
-    "first-scan"
-  ],
-  "previousGrade": "B"
-}

package/src/ir/.agentic-security/threat-model.json

@@ -1,143 +0,0 @@
-{
-  "entities": [],
-  "boundaries": [],
-  "assets": [],
-  "threats": [
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-915",
-      "family": "mass-assignment",
-      "severity": "high",
-      "file": "parser-cs.js",
-      "vuln": "Mass Assignment (req.body Direct to Model)",
-      "finding_id": "struct:parser-cs.js:208:Mass_Assignment_(req.body_Direct_to_Model)",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-915",
-      "family": "mass-assignment",
-      "severity": "high",
-      "file": "parser-go.js",
-      "vuln": "Mass Assignment (req.body Direct to Model)",
-      "finding_id": "struct:parser-go.js:253:Mass_Assignment_(req.body_Direct_to_Model)",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-915",
-      "family": "mass-assignment",
-      "severity": "high",
-      "file": "parser-kt.js",
-      "vuln": "Mass Assignment (req.body Direct to Model)",
-      "finding_id": "struct:parser-kt.js:207:Mass_Assignment_(req.body_Direct_to_Model)",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-915",
-      "family": "mass-assignment",
-      "severity": "high",
-      "file": "parser-php.js",
-      "vuln": "Mass Assignment (req.body Direct to Model)",
-      "finding_id": "struct:parser-php.js:209:Mass_Assignment_(req.body_Direct_to_Model)",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-915",
-      "family": "mass-assignment",
-      "severity": "high",
-      "file": "parser-rb.js",
-      "vuln": "Mass Assignment (req.body Direct to Model)",
-      "finding_id": "struct:parser-rb.js:201:Mass_Assignment_(req.body_Direct_to_Model)",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-400",
-      "family": "dos-sync-io",
-      "severity": "medium",
-      "file": "cpp-preprocessor.js",
-      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
-      "finding_id": "struct:cpp-preprocessor.js:94:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-400",
-      "family": "dos-sync-io",
-      "severity": "medium",
-      "file": "type-stubs.js",
-      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
-      "finding_id": "struct:type-stubs.js:48:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-400",
-      "family": "dos-sync-io",
-      "severity": "medium",
-      "file": "parser-py-cst.js",
-      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
-      "finding_id": "struct:parser-py-cst.js:91:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "I",
-      "strideLabel": "Information Disclosure",
-      "cwe": "CWE-327",
-      "family": "crypto-weak-hash",
-      "severity": "medium",
-      "file": "parser-py.helper.py",
-      "line": 68,
-      "vuln": "Weak hash algorithm (MD5 / SHA-1 / MD2 / MD4) used",
-      "finding_id": "crypto-weak-hash:parser-py.helper.py:68",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-367",
-      "family": "toctou-file-existence-permission-check-b",
-      "severity": "medium",
-      "file": "type-stubs.js",
-      "line": 48,
-      "vuln": "TOCTOU: file existence/permission check before open",
-      "finding_id": "toctou-fs:type-stubs.js:48",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-176",
-      "family": "path-normalization",
-      "severity": "medium",
-      "file": "universal-ir.js",
-      "line": 93,
-      "vuln": "Path Normalization Gap — extension extraction without null-byte/traversal sanitization",
-      "finding_id": "path-norm:universal-ir.js:93",
-      "affectsAsset": null,
-      "atEntity": null
-    }
-  ],
-  "attackTrees": []
-}

package/src/ir/.agentic-security/threat-model.md

@@ -1,39 +0,0 @@
-# Threat Model (auto-generated)
-
-Generated by agentic-security on 2026-05-31.
-
-This threat model is derived from static analysis of the current codebase and is regenerated on every scan. It is intended as a working artifact, not a finished compliance document.
-
-## Entities + boundaries
-
-```mermaid
-flowchart TB
-  subgraph External
-  end
-  subgraph Application
-  end
-```
-
-## Assets
-
-
-## STRIDE threats
-
-### Tampering (10)
-
-- [high] **mass-assignment** (CWE-915) at `parser-cs.js:undefined` — Mass Assignment (req.body Direct to Model)
-- [high] **mass-assignment** (CWE-915) at `parser-go.js:undefined` — Mass Assignment (req.body Direct to Model)
-- [high] **mass-assignment** (CWE-915) at `parser-kt.js:undefined` — Mass Assignment (req.body Direct to Model)
-- [high] **mass-assignment** (CWE-915) at `parser-php.js:undefined` — Mass Assignment (req.body Direct to Model)
-- [high] **mass-assignment** (CWE-915) at `parser-rb.js:undefined` — Mass Assignment (req.body Direct to Model)
-- [medium] **dos-sync-io** (CWE-400) at `cpp-preprocessor.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [medium] **dos-sync-io** (CWE-400) at `type-stubs.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [medium] **dos-sync-io** (CWE-400) at `parser-py-cst.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [medium] **toctou-file-existence-permission-check-b** (CWE-367) at `type-stubs.js:48` — TOCTOU: file existence/permission check before open
-- [medium] **path-normalization** (CWE-176) at `universal-ir.js:93` — Path Normalization Gap — extension extraction without null-byte/traversal sanitization
-
-### Information Disclosure (1)
-
-- [medium] **crypto-weak-hash** (CWE-327) at `parser-py.helper.py:68` — Weak hash algorithm (MD5 / SHA-1 / MD2 / MD4) used
-
-## Attack trees