@clear-capabilities/agentic-security-scanner 0.118.2 → 0.119.1

package/src/posture/.agentic-security/threat-model.md

@@ -1,73 +0,0 @@
-# Threat Model (auto-generated)
-
-Generated by agentic-security on 2026-05-31.
-
-This threat model is derived from static analysis of the current codebase and is regenerated on every scan. It is intended as a working artifact, not a finished compliance document.
-
-## Entities + boundaries
-
-```mermaid
-flowchart TB
-  subgraph External
-    route_GET__api_users_2["http-route: GET /api/users/2"]
-    route_GET__api_admin_users["http-route: GET /api/admin/users"]
-    route_GET__api_health["http-route: GET /api/health"]
-  end
-  subgraph Application
-  end
-  External --> route_GET__api_users_2
-  External --> route_GET__api_admin_users
-  External --> route_GET__api_health
-```
-
-## Assets
-
-
-## STRIDE threats
-
-### Tampering (148)
-
-- [medium] **dos-sync-io** (CWE-400) at `deploy-platform.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **mass-assignment** (CWE-915) at `integrity.js:undefined` — Mass Assignment (req.body Direct to Model)
-- [low] **dos-sync-io** (CWE-400) at `agents-memory.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `api-contract.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `auditor-walkthrough.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `auth-posture-import.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `blast-radius.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `calibration-drift.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `calibration.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `compliance-policy.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `cross-repo-memory.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `custom-rules.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `cve-alert-daemon.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `cve-lookup.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `dep-add-guard.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `deterministic.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `epss.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `exploitability-probability.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `feature-flags.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `federated-learning.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `findings-memory.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `fix-history.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `fix-plan.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `fix-style-mirror.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `fix-verify-loop.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- … and 123 more
-
-### Information Disclosure (5)
-
-- [low] **ssrf** (CWE-918) at `attack-playbooks.js:72` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `defender-agent.js:41` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `flow-narration.js:24` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **pqc-migration** (CWE-327) at `rule-pack-signing.js:187` — Pre-quantum ED25519 (ed25519) — replace with ML-DSA-65 before CRQC arrives
-- [low] **ssrf** (CWE-918) at `verifier.js:55` — SSRF: explicit reference to cloud instance-metadata endpoint
-
-### Elevation of Privilege (5)
-
-- [low] **ssrf** (CWE-918) at `attack-playbooks.js:72` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **prototype-pollution** (CWE-1321) at `adversarial-self-test.js:60` — Prototype Pollution: Direct write to __proto__ / constructor.prototype
-- [low] **ssrf** (CWE-918) at `defender-agent.js:41` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `flow-narration.js:24` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `verifier.js:55` — SSRF: explicit reference to cloud instance-metadata endpoint
-
-## Attack trees

package/src/posture/compliance-frameworks/.agentic-security/findings.json

@@ -1,80 +0,0 @@
-{
-  "scanId": "aeb3cf41-7bb6-49c6-b4ae-b126e5afd726",
-  "startedAt": "2026-05-29T21:02:56.188Z",
-  "durationMs": 15,
-  "scanned": {
-    "files": 0,
-    "lines": 0
-  },
-  "findings": [],
-  "bundles": [],
-  "routes": [],
-  "components": [],
-  "suppressedCount": 0,
-  "blastRadiusSignals": {
-    "industry": "generic",
-    "industryConfidence": "low",
-    "jurisdictions": [],
-    "controls": [],
-    "estimatedUsers": 50,
-    "revenueIndicator": "pre-revenue",
-    "hasStripe": false,
-    "hasAuth": false,
-    "hasUserTable": false,
-    "hasPII": false,
-    "hasPHI": false,
-    "hasS3": false
-  },
-  "_v3": {
-    "counterfactual": {
-      "spofControls": [],
-      "note": "no-controls-detected"
-    },
-    "threatModel": {
-      "summary": {
-        "assetCount": 0,
-        "boundaryCount": 0,
-        "strideCounts": {
-          "spoofing": 0,
-          "tampering": 0,
-          "repudiation": 0,
-          "informationDisclosure": 0,
-          "denialOfService": 0,
-          "elevationOfPrivilege": 0
-        }
-      },
-      "assets": [],
-      "trustBoundaries": [],
-      "stride": {
-        "spoofing": [],
-        "tampering": [],
-        "repudiation": [],
-        "informationDisclosure": [],
-        "denialOfService": [],
-        "elevationOfPrivilege": []
-      }
-    },
-    "trustBoundaryDiagram": {
-      "mermaid": "flowchart LR\n  INTERNET((Internet))\n  APP[\"Application\"]\n  classDef sev_critical fill:#ffcccc,stroke:#a00,stroke-width:2px;\n  classDef sev_high fill:#ffe0b2,stroke:#c60,stroke-width:2px;\n  classDef sev_medium fill:#fff3cd,stroke:#a80;\n  classDef sev_low fill:#e8eaf6,stroke:#557;",
-      "nodes": [
-        {
-          "id": "INTERNET",
-          "kind": "external",
-          "label": "Internet"
-        },
-        {
-          "id": "APP",
-          "kind": "app",
-          "label": "Application"
-        }
-      ],
-      "edges": [],
-      "decorations": []
-    },
-    "calibrationDrift": {
-      "alarms": [],
-      "note": "no-feedback-data"
-    }
-  },
-  "annotatorErrors": []
-}

package/src/posture/compliance-frameworks/.agentic-security/last-scan.json

@@ -1,80 +0,0 @@
-{
-  "scanId": "aeb3cf41-7bb6-49c6-b4ae-b126e5afd726",
-  "startedAt": "2026-05-29T21:02:56.188Z",
-  "durationMs": 15,
-  "scanned": {
-    "files": 0,
-    "lines": 0
-  },
-  "findings": [],
-  "bundles": [],
-  "routes": [],
-  "components": [],
-  "suppressedCount": 0,
-  "blastRadiusSignals": {
-    "industry": "generic",
-    "industryConfidence": "low",
-    "jurisdictions": [],
-    "controls": [],
-    "estimatedUsers": 50,
-    "revenueIndicator": "pre-revenue",
-    "hasStripe": false,
-    "hasAuth": false,
-    "hasUserTable": false,
-    "hasPII": false,
-    "hasPHI": false,
-    "hasS3": false
-  },
-  "_v3": {
-    "counterfactual": {
-      "spofControls": [],
-      "note": "no-controls-detected"
-    },
-    "threatModel": {
-      "summary": {
-        "assetCount": 0,
-        "boundaryCount": 0,
-        "strideCounts": {
-          "spoofing": 0,
-          "tampering": 0,
-          "repudiation": 0,
-          "informationDisclosure": 0,
-          "denialOfService": 0,
-          "elevationOfPrivilege": 0
-        }
-      },
-      "assets": [],
-      "trustBoundaries": [],
-      "stride": {
-        "spoofing": [],
-        "tampering": [],
-        "repudiation": [],
-        "informationDisclosure": [],
-        "denialOfService": [],
-        "elevationOfPrivilege": []
-      }
-    },
-    "trustBoundaryDiagram": {
-      "mermaid": "flowchart LR\n  INTERNET((Internet))\n  APP[\"Application\"]\n  classDef sev_critical fill:#ffcccc,stroke:#a00,stroke-width:2px;\n  classDef sev_high fill:#ffe0b2,stroke:#c60,stroke-width:2px;\n  classDef sev_medium fill:#fff3cd,stroke:#a80;\n  classDef sev_low fill:#e8eaf6,stroke:#557;",
-      "nodes": [
-        {
-          "id": "INTERNET",
-          "kind": "external",
-          "label": "Internet"
-        },
-        {
-          "id": "APP",
-          "kind": "app",
-          "label": "Application"
-        }
-      ],
-      "edges": [],
-      "decorations": []
-    },
-    "calibrationDrift": {
-      "alarms": [],
-      "note": "no-feedback-data"
-    }
-  },
-  "annotatorErrors": []
-}

package/src/posture/compliance-frameworks/.agentic-security/last-scan.json.sig

@@ -1 +0,0 @@
-ccd53b45945cf534ddf095b46bb3a987246676e48f0308cf01946295f9d3e448

package/src/posture/compliance-frameworks/.agentic-security/scan-history.json

@@ -1,90 +0,0 @@
-[
-  {
-    "timestamp": "2026-05-29T21:01:01.146Z",
-    "label": "scan",
-    "total": 0,
-    "critical": 0,
-    "high": 0,
-    "medium": 0,
-    "low": 0,
-    "kev": 0,
-    "ids": []
-  },
-  {
-    "timestamp": "2026-05-29T21:01:20.024Z",
-    "label": "scan",
-    "total": 0,
-    "critical": 0,
-    "high": 0,
-    "medium": 0,
-    "low": 0,
-    "kev": 0,
-    "ids": []
-  },
-  {
-    "timestamp": "2026-05-29T21:01:41.003Z",
-    "label": "scan",
-    "total": 0,
-    "critical": 0,
-    "high": 0,
-    "medium": 0,
-    "low": 0,
-    "kev": 0,
-    "ids": []
-  },
-  {
-    "timestamp": "2026-05-29T21:01:56.122Z",
-    "label": "scan",
-    "total": 0,
-    "critical": 0,
-    "high": 0,
-    "medium": 0,
-    "low": 0,
-    "kev": 0,
-    "ids": []
-  },
-  {
-    "timestamp": "2026-05-29T21:02:10.982Z",
-    "label": "scan",
-    "total": 0,
-    "critical": 0,
-    "high": 0,
-    "medium": 0,
-    "low": 0,
-    "kev": 0,
-    "ids": []
-  },
-  {
-    "timestamp": "2026-05-29T21:02:27.759Z",
-    "label": "scan",
-    "total": 0,
-    "critical": 0,
-    "high": 0,
-    "medium": 0,
-    "low": 0,
-    "kev": 0,
-    "ids": []
-  },
-  {
-    "timestamp": "2026-05-29T21:02:44.397Z",
-    "label": "scan",
-    "total": 0,
-    "critical": 0,
-    "high": 0,
-    "medium": 0,
-    "low": 0,
-    "kev": 0,
-    "ids": []
-  },
-  {
-    "timestamp": "2026-05-29T21:02:56.203Z",
-    "label": "scan",
-    "total": 0,
-    "critical": 0,
-    "high": 0,
-    "medium": 0,
-    "low": 0,
-    "kev": 0,
-    "ids": []
-  }
-]

package/src/posture/compliance-frameworks/.agentic-security/streak.json

@@ -1,22 +0,0 @@
-{
-  "firstScanDate": "2026-05-29T21:01:01.152Z",
-  "lastScanDate": "2026-05-29T21:02:56.210Z",
-  "totalScans": 8,
-  "daysCleanCritical": 1,
-  "lastCleanDate": "2026-05-29",
-  "lastCriticalDate": null,
-  "hasEverHadCritical": false,
-  "bestDaysCleanCritical": 1,
-  "totalFindingsAtFirstScan": 0,
-  "totalFindingsAtLastScan": 0,
-  "totalFixesInferred": 0,
-  "lastGrade": "A+",
-  "bestGrade": "A+",
-  "launchCheckPassedAt": null,
-  "achievements": [
-    "first-scan",
-    "grade-a",
-    "grade-a-plus"
-  ],
-  "previousGrade": "A+"
-}

package/src/report/.agentic-security/dpia.md

@@ -1,26 +0,0 @@
-# Data Protection Impact Assessment (DPIA)
-
-Generated by agentic-security scanner on 2026-05-31.
-
-This is an automated DPIA scaffold derived from static analysis.
-It must be reviewed and completed by a privacy officer before use.
-
-## Data classes identified
-
-## Privacy-related findings
-
-| Severity | File:Line | Class → Sink | Description |
-|---|---|---|---|
-
-## Regulatory framework mapping
-
-- **GDPR Art. 35** — DPIA required when processing is likely to result in high risk to data subjects.
-- **CCPA §1798.130** — Notice + access rights for collected personal information.
-
-## Reviewer checklist
-
-- [ ] Confirm each PII field's collection has a documented lawful basis
-- [ ] Confirm retention period for each class is documented
-- [ ] Confirm DSAR (data subject access request) workflow exists
-- [ ] Confirm encryption at rest + in transit for each class
-- [ ] Confirm logging of PII access for audit (where applicable)

package/src/report/.agentic-security/sbom-history/7d45b5e03804aac084b4a2b4dc8c6f10107d2005.json

@@ -1,6 +0,0 @@
-{
-  "sha": "7d45b5e03804aac084b4a2b4dc8c6f10107d2005",
-  "ts": "2026-05-30T05:08:01.641Z",
-  "componentCount": 0,
-  "components": []
-}

package/src/report/.agentic-security/sbom-history/f94be839aa6a1011f53da016416a561698b8f338.json

@@ -1,6 +0,0 @@
-{
-  "sha": "f94be839aa6a1011f53da016416a561698b8f338",
-  "ts": "2026-05-31T16:06:10.902Z",
-  "componentCount": 0,
-  "components": []
-}

package/src/report/.agentic-security/threat-model.json

@@ -1,7 +0,0 @@
-{
-  "entities": [],
-  "boundaries": [],
-  "assets": [],
-  "threats": [],
-  "attackTrees": []
-}

package/src/report/.agentic-security/threat-model.md

@@ -1,22 +0,0 @@
-# Threat Model (auto-generated)
-
-Generated by agentic-security on 2026-05-31.
-
-This threat model is derived from static analysis of the current codebase and is regenerated on every scan. It is intended as a working artifact, not a finished compliance document.
-
-## Entities + boundaries
-
-```mermaid
-flowchart TB
-  subgraph External
-  end
-  subgraph Application
-  end
-```
-
-## Assets
-
-
-## STRIDE threats
-
-## Attack trees

package/src/sast/.agentic-security/dpia.md

@@ -1,26 +0,0 @@
-# Data Protection Impact Assessment (DPIA)
-
-Generated by agentic-security scanner on 2026-06-01.
-
-This is an automated DPIA scaffold derived from static analysis.
-It must be reviewed and completed by a privacy officer before use.
-
-## Data classes identified
-
-## Privacy-related findings
-
-| Severity | File:Line | Class → Sink | Description |
-|---|---|---|---|
-
-## Regulatory framework mapping
-
-- **GDPR Art. 35** — DPIA required when processing is likely to result in high risk to data subjects.
-- **CCPA §1798.130** — Notice + access rights for collected personal information.
-
-## Reviewer checklist
-
-- [ ] Confirm each PII field's collection has a documented lawful basis
-- [ ] Confirm retention period for each class is documented
-- [ ] Confirm DSAR (data subject access request) workflow exists
-- [ ] Confirm encryption at rest + in transit for each class
-- [ ] Confirm logging of PII access for audit (where applicable)