@clear-capabilities/agentic-security-scanner 0.118.2 → 0.119.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (155) hide show
  1. package/CHANGELOG.md +256 -0
  2. package/bin/agentic-security.js +78 -1
  3. package/dist/178.index.js +1 -1
  4. package/dist/384.index.js +1 -1
  5. package/dist/415.index.js +90 -0
  6. package/dist/444.index.js +89 -0
  7. package/dist/503.index.js +288 -0
  8. package/dist/637.index.js +15 -1
  9. package/dist/838.index.js +1 -1
  10. package/dist/985.index.js +5 -1
  11. package/dist/agentic-security.mjs +18 -18
  12. package/dist/agentic-security.mjs.sha256 +1 -1
  13. package/package.json +13 -8
  14. package/src/dataflow/CLAUDE.md +1 -1
  15. package/src/dataflow/catalog.js +50 -11
  16. package/src/dataflow/engine.js +76 -1
  17. package/src/dataflow/implicit-flow.js +4 -2
  18. package/src/dataflow/index.js +9 -4
  19. package/src/dataflow/proof-gate.js +5 -0
  20. package/src/dataflow/summaries.js +19 -1
  21. package/src/engine.js +95 -7
  22. package/src/ir/parser-go.js +8 -0
  23. package/src/mcp/tools.js +6 -2
  24. package/src/posture/fix-history.js +24 -0
  25. package/src/posture/provenance.js +39 -0
  26. package/src/posture/sca-verdict.js +130 -0
  27. package/src/posture/secret-history.js +72 -0
  28. package/src/pr-delta.js +13 -0
  29. package/src/report/index.js +50 -0
  30. package/src/sast/agent-untrusted-flow.js +107 -0
  31. package/src/sast/api-authz.js +71 -0
  32. package/src/sast/cross-service.js +98 -0
  33. package/src/sast/event-entrypoint.js +90 -0
  34. package/src/sast/iac-terraform.js +107 -0
  35. package/src/sast/rbac-consistency.js +113 -0
  36. package/src/sast/wrong-context-sanitizer.js +55 -0
  37. package/src/sca/image-packages.js +74 -0
  38. package/src/sca/import-reachability.js +271 -0
  39. package/src/sca/install-script-analysis.js +82 -0
  40. package/bin/.agentic-security/findings.json +0 -1907
  41. package/bin/.agentic-security/last-scan.json +0 -1907
  42. package/bin/.agentic-security/last-scan.json.sig +0 -1
  43. package/bin/.agentic-security/scan-history.json +0 -166
  44. package/bin/.agentic-security/streak.json +0 -20
  45. package/src/.agentic-security/dpia.md +0 -26
  46. package/src/.agentic-security/findings.json +0 -117732
  47. package/src/.agentic-security/last-scan.json +0 -117732
  48. package/src/.agentic-security/last-scan.json.sig +0 -1
  49. package/src/.agentic-security/pqc-migration-plan.json +0 -80
  50. package/src/.agentic-security/pqc-migration-plan.md +0 -32
  51. package/src/.agentic-security/sbom-history/0775d96ba4cf814520d02760cfb3010760c7684f.json +0 -6
  52. package/src/.agentic-security/sbom-history/29300441d3460832137a8e51a92b74068cad2f15.json +0 -6
  53. package/src/.agentic-security/sbom-history/3852ad2aa0e50951bed0c930c29d1861aa13d048.json +0 -6
  54. package/src/.agentic-security/sbom-history/3d96e2daec97e3226c9679bac6e64a89ca10bfe9.json +0 -6
  55. package/src/.agentic-security/sbom-history/5f0b136622fce09b469a1a6137c04d5b18652ea4.json +0 -6
  56. package/src/.agentic-security/sbom-history/64e30595d447b62344d0d9200760269df2095332.json +0 -6
  57. package/src/.agentic-security/sbom-history/71f3241902c9e7437764e3caa046ba8a3bcdd32a.json +0 -6
  58. package/src/.agentic-security/sbom-history/99c372cdc33ecc9dde92960b4ffadf7775860e61.json +0 -6
  59. package/src/.agentic-security/sbom-history/9c93b15e8cf3ff2ddb8cdae92371b82e178b463c.json +0 -6
  60. package/src/.agentic-security/sbom-history/a3544abf1863d71776b61302ca74d9ead2b26a9f.json +0 -6
  61. package/src/.agentic-security/sbom-history/dca15abdec43c508aa342db86dc5db8d7f01fbbe.json +0 -6
  62. package/src/.agentic-security/scan-history.json +0 -12946
  63. package/src/.agentic-security/streak.json +0 -21
  64. package/src/.agentic-security/threat-model.json +0 -3702
  65. package/src/.agentic-security/threat-model.md +0 -118
  66. package/src/dataflow/.agentic-security/dpia.md +0 -26
  67. package/src/dataflow/.agentic-security/findings.json +0 -6086
  68. package/src/dataflow/.agentic-security/last-scan.json +0 -6086
  69. package/src/dataflow/.agentic-security/last-scan.json.sig +0 -1
  70. package/src/dataflow/.agentic-security/sbom-history/15d7c4d20f9d968ebec29445c9e9b3fc6f74e6a1.json +0 -6
  71. package/src/dataflow/.agentic-security/sbom-history/3852ad2aa0e50951bed0c930c29d1861aa13d048.json +0 -6
  72. package/src/dataflow/.agentic-security/sbom-history/73166872888d9ddcbe98645af818ecc7d8917b07.json +0 -6
  73. package/src/dataflow/.agentic-security/sbom-history/8869fe64035bec0152d92ece961e9369d8637076.json +0 -6
  74. package/src/dataflow/.agentic-security/sbom-history/9c93b15e8cf3ff2ddb8cdae92371b82e178b463c.json +0 -6
  75. package/src/dataflow/.agentic-security/sbom-history/b7ac2dada4a9216ccfe8969fc57f988c83f46975.json +0 -6
  76. package/src/dataflow/.agentic-security/scan-history.json +0 -250
  77. package/src/dataflow/.agentic-security/streak.json +0 -21
  78. package/src/dataflow/.agentic-security/threat-model.json +0 -161
  79. package/src/dataflow/.agentic-security/threat-model.md +0 -43
  80. package/src/ir/.agentic-security/dpia.md +0 -26
  81. package/src/ir/.agentic-security/exploit-bundles.json +0 -77
  82. package/src/ir/.agentic-security/findings.json +0 -4011
  83. package/src/ir/.agentic-security/last-scan.json +0 -4011
  84. package/src/ir/.agentic-security/last-scan.json.sig +0 -1
  85. package/src/ir/.agentic-security/sbom-history/73166872888d9ddcbe98645af818ecc7d8917b07.json +0 -6
  86. package/src/ir/.agentic-security/sbom-history/b5f468a158f6a145aedd8680841c106b9809f16b.json +0 -6
  87. package/src/ir/.agentic-security/scan-history.json +0 -193
  88. package/src/ir/.agentic-security/streak.json +0 -20
  89. package/src/ir/.agentic-security/threat-model.json +0 -143
  90. package/src/ir/.agentic-security/threat-model.md +0 -39
  91. package/src/mcp/.agentic-security/findings.json +0 -8632
  92. package/src/mcp/.agentic-security/last-scan.json +0 -8632
  93. package/src/mcp/.agentic-security/last-scan.json.sig +0 -1
  94. package/src/mcp/.agentic-security/scan-history.json +0 -331
  95. package/src/mcp/.agentic-security/streak.json +0 -20
  96. package/src/posture/.agentic-security/dpia.md +0 -26
  97. package/src/posture/.agentic-security/findings.json +0 -77181
  98. package/src/posture/.agentic-security/last-scan.json +0 -77181
  99. package/src/posture/.agentic-security/last-scan.json.sig +0 -1
  100. package/src/posture/.agentic-security/pqc-migration-plan.json +0 -65
  101. package/src/posture/.agentic-security/pqc-migration-plan.md +0 -30
  102. package/src/posture/.agentic-security/sbom-history/0724c133d2943c87555695b5b2adcfcfc3373a2d.json +0 -6
  103. package/src/posture/.agentic-security/sbom-history/7d45b5e03804aac084b4a2b4dc8c6f10107d2005.json +0 -6
  104. package/src/posture/.agentic-security/sbom-history/99c372cdc33ecc9dde92960b4ffadf7775860e61.json +0 -6
  105. package/src/posture/.agentic-security/sbom-history/b7ac2dada4a9216ccfe8969fc57f988c83f46975.json +0 -6
  106. package/src/posture/.agentic-security/scan-history.json +0 -8904
  107. package/src/posture/.agentic-security/streak.json +0 -21
  108. package/src/posture/.agentic-security/threat-model.json +0 -2038
  109. package/src/posture/.agentic-security/threat-model.md +0 -73
  110. package/src/posture/compliance-frameworks/.agentic-security/findings.json +0 -80
  111. package/src/posture/compliance-frameworks/.agentic-security/last-scan.json +0 -80
  112. package/src/posture/compliance-frameworks/.agentic-security/last-scan.json.sig +0 -1
  113. package/src/posture/compliance-frameworks/.agentic-security/scan-history.json +0 -90
  114. package/src/posture/compliance-frameworks/.agentic-security/streak.json +0 -22
  115. package/src/report/.agentic-security/dpia.md +0 -26
  116. package/src/report/.agentic-security/sbom-history/7d45b5e03804aac084b4a2b4dc8c6f10107d2005.json +0 -6
  117. package/src/report/.agentic-security/sbom-history/f94be839aa6a1011f53da016416a561698b8f338.json +0 -6
  118. package/src/report/.agentic-security/threat-model.json +0 -7
  119. package/src/report/.agentic-security/threat-model.md +0 -22
  120. package/src/sast/.agentic-security/dpia.md +0 -26
  121. package/src/sast/.agentic-security/findings.json +0 -6154
  122. package/src/sast/.agentic-security/last-scan.json +0 -6154
  123. package/src/sast/.agentic-security/last-scan.json.sig +0 -1
  124. package/src/sast/.agentic-security/pqc-migration-plan.json +0 -65
  125. package/src/sast/.agentic-security/pqc-migration-plan.md +0 -30
  126. package/src/sast/.agentic-security/sbom-history/043a7b401c68f5a298c83d4c42e94f118ff2a89a.json +0 -6
  127. package/src/sast/.agentic-security/sbom-history/0775d96ba4cf814520d02760cfb3010760c7684f.json +0 -6
  128. package/src/sast/.agentic-security/sbom-history/20d77ad7363a82777d506dedbbb1ecfed52f094a.json +0 -6
  129. package/src/sast/.agentic-security/sbom-history/29300441d3460832137a8e51a92b74068cad2f15.json +0 -6
  130. package/src/sast/.agentic-security/sbom-history/3852ad2aa0e50951bed0c930c29d1861aa13d048.json +0 -6
  131. package/src/sast/.agentic-security/sbom-history/3c6b3205f04e26f7654943d465281d00e0fa395e.json +0 -6
  132. package/src/sast/.agentic-security/sbom-history/3d96e2daec97e3226c9679bac6e64a89ca10bfe9.json +0 -6
  133. package/src/sast/.agentic-security/sbom-history/5282502e090013219eb006f7e02d8c983bc29c8e.json +0 -6
  134. package/src/sast/.agentic-security/sbom-history/5f0b136622fce09b469a1a6137c04d5b18652ea4.json +0 -6
  135. package/src/sast/.agentic-security/sbom-history/64e30595d447b62344d0d9200760269df2095332.json +0 -6
  136. package/src/sast/.agentic-security/sbom-history/71f3241902c9e7437764e3caa046ba8a3bcdd32a.json +0 -6
  137. package/src/sast/.agentic-security/sbom-history/73514b485d4770f3c5ee57d87338bccd1c61d8b7.json +0 -6
  138. package/src/sast/.agentic-security/sbom-history/96fa584fc3134512237d58aac63d6f3778b0cbcb.json +0 -6
  139. package/src/sast/.agentic-security/sbom-history/99c372cdc33ecc9dde92960b4ffadf7775860e61.json +0 -6
  140. package/src/sast/.agentic-security/sbom-history/a3544abf1863d71776b61302ca74d9ead2b26a9f.json +0 -6
  141. package/src/sast/.agentic-security/sbom-history/a4a34ab8b3d758de2adc8c3dc3e42d4cb0db00a3.json +0 -6
  142. package/src/sast/.agentic-security/sbom-history/ac236ec3602cfc8fb133f389ec3687e409084673.json +0 -6
  143. package/src/sast/.agentic-security/sbom-history/b57b3e1292f1f9f0de6c5a34a436e330c78008a3.json +0 -6
  144. package/src/sast/.agentic-security/sbom-history/dca15abdec43c508aa342db86dc5db8d7f01fbbe.json +0 -6
  145. package/src/sast/.agentic-security/sbom-history/dcbfd4935922dd165093c08a1003c338eed937c5.json +0 -6
  146. package/src/sast/.agentic-security/sbom-history/fa017f725615b0293814344c8ef7dfeb06775ca0.json +0 -6
  147. package/src/sast/.agentic-security/scan-history.json +0 -941
  148. package/src/sast/.agentic-security/streak.json +0 -22
  149. package/src/sast/.agentic-security/threat-model.json +0 -816
  150. package/src/sast/.agentic-security/threat-model.md +0 -91
  151. package/src/sca/.agentic-security/findings.json +0 -7460
  152. package/src/sca/.agentic-security/last-scan.json +0 -7460
  153. package/src/sca/.agentic-security/last-scan.json.sig +0 -1
  154. package/src/sca/.agentic-security/scan-history.json +0 -113
  155. package/src/sca/.agentic-security/streak.json +0 -21
package/src/sast/.agentic-security/scan-history.json DELETED
@@ -1,941 +0,0 @@
1
- [
2
- {
3
- "timestamp": "2026-05-28T21:53:59.953Z",
4
- "label": "scan",
5
- "total": 17,
6
- "critical": 0,
7
- "high": 0,
8
- "medium": 2,
9
- "low": 15,
10
- "kev": 0,
11
- "ids": [
12
- "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
13
- "client-side:CLIENT_EVAL:client-side.js:135",
14
- "client-side:CLIENT_EVAL:client-side.js:139",
15
- "client-side:CLIENT_EVAL:client-side.js:140",
16
- "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
17
- "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
18
- "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
19
- "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
20
- "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
21
- "spec-drift:rate-limit-impl:rate-limit.js:34",
22
- "spec-drift:rate-limit-impl:rate-limit.js:77",
23
- "ssrf-meta-hardcoded:go-extended.js:39",
24
- "ssrf-meta-hardcoded:python-sinks.js:186",
25
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
26
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
27
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
28
- "zip-slip:zip-slip.js:192:node-entry"
29
- ]
30
- },
31
- {
32
- "timestamp": "2026-05-28T21:55:15.110Z",
33
- "label": "scan",
34
- "total": 17,
35
- "critical": 0,
36
- "high": 0,
37
- "medium": 2,
38
- "low": 15,
39
- "kev": 0,
40
- "ids": [
41
- "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
42
- "client-side:CLIENT_EVAL:client-side.js:135",
43
- "client-side:CLIENT_EVAL:client-side.js:139",
44
- "client-side:CLIENT_EVAL:client-side.js:140",
45
- "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
46
- "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
47
- "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
48
- "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
49
- "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
50
- "spec-drift:rate-limit-impl:rate-limit.js:34",
51
- "spec-drift:rate-limit-impl:rate-limit.js:77",
52
- "ssrf-meta-hardcoded:go-extended.js:39",
53
- "ssrf-meta-hardcoded:python-sinks.js:186",
54
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
55
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
56
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
57
- "zip-slip:zip-slip.js:192:node-entry"
58
- ]
59
- },
60
- {
61
- "timestamp": "2026-05-28T21:55:49.362Z",
62
- "label": "scan",
63
- "total": 17,
64
- "critical": 0,
65
- "high": 0,
66
- "medium": 2,
67
- "low": 15,
68
- "kev": 0,
69
- "ids": [
70
- "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
71
- "client-side:CLIENT_EVAL:client-side.js:135",
72
- "client-side:CLIENT_EVAL:client-side.js:139",
73
- "client-side:CLIENT_EVAL:client-side.js:140",
74
- "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
75
- "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
76
- "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
77
- "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
78
- "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
79
- "spec-drift:rate-limit-impl:rate-limit.js:34",
80
- "spec-drift:rate-limit-impl:rate-limit.js:77",
81
- "ssrf-meta-hardcoded:go-extended.js:39",
82
- "ssrf-meta-hardcoded:python-sinks.js:186",
83
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
84
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
85
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
86
- "zip-slip:zip-slip.js:192:node-entry"
87
- ]
88
- },
89
- {
90
- "timestamp": "2026-05-28T21:56:14.244Z",
91
- "label": "scan",
92
- "total": 17,
93
- "critical": 0,
94
- "high": 0,
95
- "medium": 2,
96
- "low": 15,
97
- "kev": 0,
98
- "ids": [
99
- "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
100
- "client-side:CLIENT_EVAL:client-side.js:135",
101
- "client-side:CLIENT_EVAL:client-side.js:139",
102
- "client-side:CLIENT_EVAL:client-side.js:140",
103
- "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
104
- "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
105
- "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
106
- "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
107
- "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
108
- "spec-drift:rate-limit-impl:rate-limit.js:34",
109
- "spec-drift:rate-limit-impl:rate-limit.js:77",
110
- "ssrf-meta-hardcoded:go-extended.js:39",
111
- "ssrf-meta-hardcoded:python-sinks.js:186",
112
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
113
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
114
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
115
- "zip-slip:zip-slip.js:192:node-entry"
116
- ]
117
- },
118
- {
119
- "timestamp": "2026-05-28T21:56:19.253Z",
120
- "label": "scan",
121
- "total": 17,
122
- "critical": 0,
123
- "high": 0,
124
- "medium": 2,
125
- "low": 15,
126
- "kev": 0,
127
- "ids": [
128
- "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
129
- "client-side:CLIENT_EVAL:client-side.js:135",
130
- "client-side:CLIENT_EVAL:client-side.js:139",
131
- "client-side:CLIENT_EVAL:client-side.js:140",
132
- "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
133
- "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
134
- "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
135
- "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
136
- "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
137
- "spec-drift:rate-limit-impl:rate-limit.js:34",
138
- "spec-drift:rate-limit-impl:rate-limit.js:77",
139
- "ssrf-meta-hardcoded:go-extended.js:39",
140
- "ssrf-meta-hardcoded:python-sinks.js:186",
141
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
142
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
143
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
144
- "zip-slip:zip-slip.js:192:node-entry"
145
- ]
146
- },
147
- {
148
- "timestamp": "2026-05-29T06:46:02.197Z",
149
- "label": "scan",
150
- "total": 18,
151
- "critical": 0,
152
- "high": 0,
153
- "medium": 2,
154
- "low": 16,
155
- "kev": 0,
156
- "ids": [
157
- "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
158
- "client-side:CLIENT_EVAL:client-side.js:135",
159
- "client-side:CLIENT_EVAL:client-side.js:139",
160
- "client-side:CLIENT_EVAL:client-side.js:140",
161
- "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
162
- "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
163
- "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
164
- "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
165
- "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
166
- "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
167
- "spec-drift:rate-limit-impl:rate-limit.js:34",
168
- "spec-drift:rate-limit-impl:rate-limit.js:77",
169
- "ssrf-meta-hardcoded:go-extended.js:39",
170
- "ssrf-meta-hardcoded:python-sinks.js:186",
171
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
172
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
173
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
174
- "zip-slip:zip-slip.js:192:node-entry"
175
- ]
176
- },
177
- {
178
- "timestamp": "2026-05-29T06:48:50.278Z",
179
- "label": "scan",
180
- "total": 18,
181
- "critical": 0,
182
- "high": 0,
183
- "medium": 2,
184
- "low": 16,
185
- "kev": 0,
186
- "ids": [
187
- "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
188
- "client-side:CLIENT_EVAL:client-side.js:135",
189
- "client-side:CLIENT_EVAL:client-side.js:139",
190
- "client-side:CLIENT_EVAL:client-side.js:140",
191
- "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
192
- "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
193
- "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
194
- "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
195
- "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
196
- "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
197
- "spec-drift:rate-limit-impl:rate-limit.js:34",
198
- "spec-drift:rate-limit-impl:rate-limit.js:77",
199
- "ssrf-meta-hardcoded:go-extended.js:39",
200
- "ssrf-meta-hardcoded:python-sinks.js:186",
201
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
202
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
203
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
204
- "zip-slip:zip-slip.js:192:node-entry"
205
- ]
206
- },
207
- {
208
- "timestamp": "2026-05-29T14:13:35.120Z",
209
- "label": "scan",
210
- "total": 18,
211
- "critical": 0,
212
- "high": 0,
213
- "medium": 2,
214
- "low": 16,
215
- "kev": 0,
216
- "ids": [
217
- "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
218
- "client-side:CLIENT_EVAL:client-side.js:135",
219
- "client-side:CLIENT_EVAL:client-side.js:139",
220
- "client-side:CLIENT_EVAL:client-side.js:140",
221
- "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
222
- "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
223
- "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
224
- "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
225
- "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
226
- "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
227
- "spec-drift:rate-limit-impl:rate-limit.js:34",
228
- "spec-drift:rate-limit-impl:rate-limit.js:77",
229
- "ssrf-meta-hardcoded:go-extended.js:39",
230
- "ssrf-meta-hardcoded:python-sinks.js:186",
231
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
232
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
233
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
234
- "zip-slip:zip-slip.js:192:node-entry"
235
- ]
236
- },
237
- {
238
- "timestamp": "2026-05-29T14:26:21.588Z",
239
- "label": "scan",
240
- "total": 18,
241
- "critical": 0,
242
- "high": 0,
243
- "medium": 2,
244
- "low": 16,
245
- "kev": 0,
246
- "ids": [
247
- "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
248
- "client-side:CLIENT_EVAL:client-side.js:135",
249
- "client-side:CLIENT_EVAL:client-side.js:139",
250
- "client-side:CLIENT_EVAL:client-side.js:140",
251
- "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
252
- "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
253
- "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
254
- "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
255
- "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
256
- "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
257
- "spec-drift:rate-limit-impl:rate-limit.js:34",
258
- "spec-drift:rate-limit-impl:rate-limit.js:77",
259
- "ssrf-meta-hardcoded:go-extended.js:39",
260
- "ssrf-meta-hardcoded:python-sinks.js:186",
261
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
262
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
263
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
264
- "zip-slip:zip-slip.js:192:node-entry"
265
- ]
266
- },
267
- {
268
- "timestamp": "2026-05-29T14:27:33.225Z",
269
- "label": "scan",
270
- "total": 18,
271
- "critical": 0,
272
- "high": 0,
273
- "medium": 2,
274
- "low": 16,
275
- "kev": 0,
276
- "ids": [
277
- "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
278
- "client-side:CLIENT_EVAL:client-side.js:135",
279
- "client-side:CLIENT_EVAL:client-side.js:139",
280
- "client-side:CLIENT_EVAL:client-side.js:140",
281
- "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
282
- "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
283
- "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
284
- "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
285
- "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
286
- "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
287
- "spec-drift:rate-limit-impl:rate-limit.js:34",
288
- "spec-drift:rate-limit-impl:rate-limit.js:77",
289
- "ssrf-meta-hardcoded:go-extended.js:39",
290
- "ssrf-meta-hardcoded:python-sinks.js:186",
291
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
292
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
293
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
294
- "zip-slip:zip-slip.js:192:node-entry"
295
- ]
296
- },
297
- {
298
- "timestamp": "2026-05-29T14:30:05.515Z",
299
- "label": "scan",
300
- "total": 18,
301
- "critical": 0,
302
- "high": 0,
303
- "medium": 2,
304
- "low": 16,
305
- "kev": 0,
306
- "ids": [
307
- "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
308
- "client-side:CLIENT_EVAL:client-side.js:135",
309
- "client-side:CLIENT_EVAL:client-side.js:139",
310
- "client-side:CLIENT_EVAL:client-side.js:140",
311
- "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
312
- "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
313
- "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
314
- "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
315
- "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
316
- "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
317
- "spec-drift:rate-limit-impl:rate-limit.js:34",
318
- "spec-drift:rate-limit-impl:rate-limit.js:77",
319
- "ssrf-meta-hardcoded:go-extended.js:39",
320
- "ssrf-meta-hardcoded:python-sinks.js:186",
321
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
322
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
323
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
324
- "zip-slip:zip-slip.js:192:node-entry"
325
- ]
326
- },
327
- {
328
- "timestamp": "2026-05-29T15:08:40.086Z",
329
- "label": "scan",
330
- "total": 18,
331
- "critical": 0,
332
- "high": 0,
333
- "medium": 2,
334
- "low": 16,
335
- "kev": 0,
336
- "ids": [
337
- "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
338
- "client-side:CLIENT_EVAL:client-side.js:135",
339
- "client-side:CLIENT_EVAL:client-side.js:139",
340
- "client-side:CLIENT_EVAL:client-side.js:140",
341
- "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
342
- "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
343
- "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
344
- "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
345
- "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
346
- "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
347
- "spec-drift:rate-limit-impl:rate-limit.js:34",
348
- "spec-drift:rate-limit-impl:rate-limit.js:77",
349
- "ssrf-meta-hardcoded:go-extended.js:39",
350
- "ssrf-meta-hardcoded:python-sinks.js:186",
351
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
352
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
353
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
354
- "zip-slip:zip-slip.js:192:node-entry"
355
- ]
356
- },
357
- {
358
- "timestamp": "2026-05-29T15:10:05.268Z",
359
- "label": "scan",
360
- "total": 19,
361
- "critical": 0,
362
- "high": 0,
363
- "medium": 2,
364
- "low": 17,
365
- "kev": 0,
366
- "ids": [
367
- "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
368
- "client-side:CLIENT_EVAL:client-side.js:135",
369
- "client-side:CLIENT_EVAL:client-side.js:139",
370
- "client-side:CLIENT_EVAL:client-side.js:140",
371
- "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
372
- "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
373
- "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
374
- "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
375
- "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
376
- "prompt-tpl:k8s-admission.js:140:Prompt_Template__user_input_interpolated_into_prompt_string_",
377
- "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
378
- "spec-drift:rate-limit-impl:rate-limit.js:34",
379
- "spec-drift:rate-limit-impl:rate-limit.js:77",
380
- "ssrf-meta-hardcoded:go-extended.js:39",
381
- "ssrf-meta-hardcoded:python-sinks.js:186",
382
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
383
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
384
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
385
- "zip-slip:zip-slip.js:192:node-entry"
386
- ]
387
- },
388
- {
389
- "timestamp": "2026-05-29T15:12:36.888Z",
390
- "label": "scan",
391
- "total": 19,
392
- "critical": 0,
393
- "high": 0,
394
- "medium": 2,
395
- "low": 17,
396
- "kev": 0,
397
- "ids": [
398
- "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
399
- "client-side:CLIENT_EVAL:client-side.js:135",
400
- "client-side:CLIENT_EVAL:client-side.js:139",
401
- "client-side:CLIENT_EVAL:client-side.js:140",
402
- "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
403
- "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
404
- "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
405
- "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
406
- "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
407
- "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
408
- "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
409
- "spec-drift:rate-limit-impl:rate-limit.js:34",
410
- "spec-drift:rate-limit-impl:rate-limit.js:77",
411
- "ssrf-meta-hardcoded:go-extended.js:39",
412
- "ssrf-meta-hardcoded:python-sinks.js:186",
413
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
414
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
415
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
416
- "zip-slip:zip-slip.js:192:node-entry"
417
- ]
418
- },
419
- {
420
- "timestamp": "2026-05-29T15:12:45.140Z",
421
- "label": "scan",
422
- "total": 19,
423
- "critical": 0,
424
- "high": 0,
425
- "medium": 2,
426
- "low": 17,
427
- "kev": 0,
428
- "ids": [
429
- "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
430
- "client-side:CLIENT_EVAL:client-side.js:135",
431
- "client-side:CLIENT_EVAL:client-side.js:139",
432
- "client-side:CLIENT_EVAL:client-side.js:140",
433
- "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
434
- "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
435
- "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
436
- "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
437
- "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
438
- "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
439
- "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
440
- "spec-drift:rate-limit-impl:rate-limit.js:34",
441
- "spec-drift:rate-limit-impl:rate-limit.js:77",
442
- "ssrf-meta-hardcoded:go-extended.js:39",
443
- "ssrf-meta-hardcoded:python-sinks.js:186",
444
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
445
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
446
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
447
- "zip-slip:zip-slip.js:192:node-entry"
448
- ]
449
- },
450
- {
451
- "timestamp": "2026-05-29T15:12:52.802Z",
452
- "label": "scan",
453
- "total": 19,
454
- "critical": 0,
455
- "high": 0,
456
- "medium": 2,
457
- "low": 17,
458
- "kev": 0,
459
- "ids": [
460
- "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
461
- "client-side:CLIENT_EVAL:client-side.js:135",
462
- "client-side:CLIENT_EVAL:client-side.js:139",
463
- "client-side:CLIENT_EVAL:client-side.js:140",
464
- "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
465
- "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
466
- "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
467
- "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
468
- "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
469
- "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
470
- "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
471
- "spec-drift:rate-limit-impl:rate-limit.js:34",
472
- "spec-drift:rate-limit-impl:rate-limit.js:77",
473
- "ssrf-meta-hardcoded:go-extended.js:39",
474
- "ssrf-meta-hardcoded:python-sinks.js:186",
475
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
476
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
477
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
478
- "zip-slip:zip-slip.js:192:node-entry"
479
- ]
480
- },
481
- {
482
- "timestamp": "2026-05-29T15:13:01.692Z",
483
- "label": "scan",
484
- "total": 19,
485
- "critical": 0,
486
- "high": 0,
487
- "medium": 2,
488
- "low": 17,
489
- "kev": 0,
490
- "ids": [
491
- "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
492
- "client-side:CLIENT_EVAL:client-side.js:135",
493
- "client-side:CLIENT_EVAL:client-side.js:139",
494
- "client-side:CLIENT_EVAL:client-side.js:140",
495
- "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
496
- "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
497
- "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
498
- "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
499
- "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
500
- "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
501
- "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
502
- "spec-drift:rate-limit-impl:rate-limit.js:34",
503
- "spec-drift:rate-limit-impl:rate-limit.js:77",
504
- "ssrf-meta-hardcoded:go-extended.js:39",
505
- "ssrf-meta-hardcoded:python-sinks.js:186",
506
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
507
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
508
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
509
- "zip-slip:zip-slip.js:192:node-entry"
510
- ]
511
- },
512
- {
513
- "timestamp": "2026-05-29T16:09:42.230Z",
514
- "label": "scan",
515
- "total": 21,
516
- "critical": 0,
517
- "high": 0,
518
- "medium": 2,
519
- "low": 19,
520
- "kev": 0,
521
- "ids": [
522
- "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
523
- "authz:crypto-protocol.js:329:AuthZ__jwt_verify_called_without_algorithms_allow_list",
524
- "authz:crypto-protocol.js:330:AuthZ__jwt_verify_called_without_algorithms_allow_list",
525
- "client-side:CLIENT_EVAL:client-side.js:135",
526
- "client-side:CLIENT_EVAL:client-side.js:139",
527
- "client-side:CLIENT_EVAL:client-side.js:140",
528
- "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
529
- "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
530
- "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
531
- "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
532
- "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
533
- "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
534
- "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
535
- "spec-drift:rate-limit-impl:rate-limit.js:34",
536
- "spec-drift:rate-limit-impl:rate-limit.js:77",
537
- "ssrf-meta-hardcoded:go-extended.js:39",
538
- "ssrf-meta-hardcoded:python-sinks.js:186",
539
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
540
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
541
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
542
- "zip-slip:zip-slip.js:192:node-entry"
543
- ]
544
- },
545
- {
546
- "timestamp": "2026-05-29T16:12:29.038Z",
547
- "label": "scan",
548
- "total": 21,
549
- "critical": 0,
550
- "high": 0,
551
- "medium": 2,
552
- "low": 19,
553
- "kev": 0,
554
- "ids": [
555
- "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
556
- "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
557
- "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
558
- "client-side:CLIENT_EVAL:client-side.js:135",
559
- "client-side:CLIENT_EVAL:client-side.js:139",
560
- "client-side:CLIENT_EVAL:client-side.js:140",
561
- "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
562
- "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
563
- "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
564
- "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
565
- "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
566
- "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
567
- "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
568
- "spec-drift:rate-limit-impl:rate-limit.js:34",
569
- "spec-drift:rate-limit-impl:rate-limit.js:77",
570
- "ssrf-meta-hardcoded:go-extended.js:39",
571
- "ssrf-meta-hardcoded:python-sinks.js:186",
572
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
573
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
574
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
575
- "zip-slip:zip-slip.js:192:node-entry"
576
- ]
577
- },
578
- {
579
- "timestamp": "2026-05-29T16:13:59.607Z",
580
- "label": "scan",
581
- "total": 21,
582
- "critical": 0,
583
- "high": 0,
584
- "medium": 2,
585
- "low": 19,
586
- "kev": 0,
587
- "ids": [
588
- "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
589
- "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
590
- "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
591
- "client-side:CLIENT_EVAL:client-side.js:135",
592
- "client-side:CLIENT_EVAL:client-side.js:139",
593
- "client-side:CLIENT_EVAL:client-side.js:140",
594
- "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
595
- "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
596
- "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
597
- "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
598
- "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
599
- "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
600
- "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
601
- "spec-drift:rate-limit-impl:rate-limit.js:34",
602
- "spec-drift:rate-limit-impl:rate-limit.js:77",
603
- "ssrf-meta-hardcoded:go-extended.js:39",
604
- "ssrf-meta-hardcoded:python-sinks.js:186",
605
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
606
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
607
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
608
- "zip-slip:zip-slip.js:192:node-entry"
609
- ]
610
- },
611
- {
612
- "timestamp": "2026-05-29T16:32:06.484Z",
613
- "label": "scan",
614
- "total": 21,
615
- "critical": 0,
616
- "high": 0,
617
- "medium": 2,
618
- "low": 19,
619
- "kev": 0,
620
- "ids": [
621
- "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
622
- "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
623
- "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
624
- "client-side:CLIENT_EVAL:client-side.js:135",
625
- "client-side:CLIENT_EVAL:client-side.js:139",
626
- "client-side:CLIENT_EVAL:client-side.js:140",
627
- "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
628
- "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
629
- "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
630
- "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
631
- "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
632
- "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
633
- "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
634
- "spec-drift:rate-limit-impl:rate-limit.js:34",
635
- "spec-drift:rate-limit-impl:rate-limit.js:77",
636
- "ssrf-meta-hardcoded:go-extended.js:39",
637
- "ssrf-meta-hardcoded:python-sinks.js:186",
638
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
639
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
640
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
641
- "zip-slip:zip-slip.js:192:node-entry"
642
- ]
643
- },
644
- {
645
- "timestamp": "2026-05-29T16:33:51.164Z",
646
- "label": "scan",
647
- "total": 21,
648
- "critical": 0,
649
- "high": 0,
650
- "medium": 2,
651
- "low": 19,
652
- "kev": 0,
653
- "ids": [
654
- "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
655
- "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
656
- "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
657
- "client-side:CLIENT_EVAL:client-side.js:135",
658
- "client-side:CLIENT_EVAL:client-side.js:139",
659
- "client-side:CLIENT_EVAL:client-side.js:140",
660
- "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
661
- "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
662
- "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
663
- "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
664
- "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
665
- "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
666
- "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
667
- "spec-drift:rate-limit-impl:rate-limit.js:34",
668
- "spec-drift:rate-limit-impl:rate-limit.js:77",
669
- "ssrf-meta-hardcoded:go-extended.js:39",
670
- "ssrf-meta-hardcoded:python-sinks.js:186",
671
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
672
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
673
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
674
- "zip-slip:zip-slip.js:192:node-entry"
675
- ]
676
- },
677
- {
678
- "timestamp": "2026-05-29T17:02:03.828Z",
679
- "label": "scan",
680
- "total": 21,
681
- "critical": 0,
682
- "high": 0,
683
- "medium": 2,
684
- "low": 19,
685
- "kev": 0,
686
- "ids": [
687
- "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
688
- "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
689
- "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
690
- "client-side:CLIENT_EVAL:client-side.js:135",
691
- "client-side:CLIENT_EVAL:client-side.js:139",
692
- "client-side:CLIENT_EVAL:client-side.js:140",
693
- "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
694
- "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
695
- "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
696
- "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
697
- "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
698
- "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
699
- "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
700
- "spec-drift:rate-limit-impl:rate-limit.js:34",
701
- "spec-drift:rate-limit-impl:rate-limit.js:77",
702
- "ssrf-meta-hardcoded:go-extended.js:39",
703
- "ssrf-meta-hardcoded:python-sinks.js:186",
704
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
705
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
706
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
707
- "zip-slip:zip-slip.js:192:node-entry"
708
- ]
709
- },
710
- {
711
- "timestamp": "2026-05-29T17:02:12.361Z",
712
- "label": "scan",
713
- "total": 21,
714
- "critical": 0,
715
- "high": 0,
716
- "medium": 2,
717
- "low": 19,
718
- "kev": 0,
719
- "ids": [
720
- "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
721
- "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
722
- "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
723
- "client-side:CLIENT_EVAL:client-side.js:135",
724
- "client-side:CLIENT_EVAL:client-side.js:139",
725
- "client-side:CLIENT_EVAL:client-side.js:140",
726
- "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
727
- "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
728
- "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
729
- "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
730
- "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
731
- "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
732
- "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
733
- "spec-drift:rate-limit-impl:rate-limit.js:34",
734
- "spec-drift:rate-limit-impl:rate-limit.js:77",
735
- "ssrf-meta-hardcoded:go-extended.js:39",
736
- "ssrf-meta-hardcoded:python-sinks.js:186",
737
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
738
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
739
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
740
- "zip-slip:zip-slip.js:192:node-entry"
741
- ]
742
- },
743
- {
744
- "timestamp": "2026-05-29T17:02:20.453Z",
745
- "label": "scan",
746
- "total": 21,
747
- "critical": 0,
748
- "high": 0,
749
- "medium": 2,
750
- "low": 19,
751
- "kev": 0,
752
- "ids": [
753
- "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
754
- "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
755
- "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
756
- "client-side:CLIENT_EVAL:client-side.js:135",
757
- "client-side:CLIENT_EVAL:client-side.js:139",
758
- "client-side:CLIENT_EVAL:client-side.js:140",
759
- "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
760
- "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
761
- "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
762
- "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
763
- "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
764
- "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
765
- "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
766
- "spec-drift:rate-limit-impl:rate-limit.js:34",
767
- "spec-drift:rate-limit-impl:rate-limit.js:77",
768
- "ssrf-meta-hardcoded:go-extended.js:39",
769
- "ssrf-meta-hardcoded:python-sinks.js:186",
770
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
771
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
772
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
773
- "zip-slip:zip-slip.js:192:node-entry"
774
- ]
775
- },
776
- {
777
- "timestamp": "2026-05-29T17:03:04.332Z",
778
- "label": "scan",
779
- "total": 21,
780
- "critical": 0,
781
- "high": 0,
782
- "medium": 2,
783
- "low": 19,
784
- "kev": 0,
785
- "ids": [
786
- "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
787
- "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
788
- "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
789
- "client-side:CLIENT_EVAL:client-side.js:135",
790
- "client-side:CLIENT_EVAL:client-side.js:139",
791
- "client-side:CLIENT_EVAL:client-side.js:140",
792
- "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
793
- "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
794
- "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
795
- "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
796
- "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
797
- "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
798
- "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
799
- "spec-drift:rate-limit-impl:rate-limit.js:34",
800
- "spec-drift:rate-limit-impl:rate-limit.js:77",
801
- "ssrf-meta-hardcoded:go-extended.js:39",
802
- "ssrf-meta-hardcoded:python-sinks.js:186",
803
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
804
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
805
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
806
- "zip-slip:zip-slip.js:192:node-entry"
807
- ]
808
- },
809
- {
810
- "timestamp": "2026-05-29T17:03:11.818Z",
811
- "label": "scan",
812
- "total": 21,
813
- "critical": 0,
814
- "high": 0,
815
- "medium": 2,
816
- "low": 19,
817
- "kev": 0,
818
- "ids": [
819
- "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
820
- "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
821
- "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
822
- "client-side:CLIENT_EVAL:client-side.js:135",
823
- "client-side:CLIENT_EVAL:client-side.js:139",
824
- "client-side:CLIENT_EVAL:client-side.js:140",
825
- "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
826
- "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
827
- "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
828
- "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
829
- "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
830
- "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
831
- "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
832
- "spec-drift:rate-limit-impl:rate-limit.js:34",
833
- "spec-drift:rate-limit-impl:rate-limit.js:77",
834
- "ssrf-meta-hardcoded:go-extended.js:39",
835
- "ssrf-meta-hardcoded:python-sinks.js:186",
836
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
837
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
838
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
839
- "zip-slip:zip-slip.js:192:node-entry"
840
- ]
841
- },
842
- {
843
- "timestamp": "2026-05-29T17:03:19.497Z",
844
- "label": "scan",
845
- "total": 21,
846
- "critical": 0,
847
- "high": 0,
848
- "medium": 2,
849
- "low": 19,
850
- "kev": 0,
851
- "ids": [
852
- "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
853
- "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
854
- "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
855
- "client-side:CLIENT_EVAL:client-side.js:135",
856
- "client-side:CLIENT_EVAL:client-side.js:139",
857
- "client-side:CLIENT_EVAL:client-side.js:140",
858
- "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
859
- "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
860
- "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
861
- "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
862
- "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
863
- "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
864
- "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
865
- "spec-drift:rate-limit-impl:rate-limit.js:34",
866
- "spec-drift:rate-limit-impl:rate-limit.js:77",
867
- "ssrf-meta-hardcoded:go-extended.js:39",
868
- "ssrf-meta-hardcoded:python-sinks.js:186",
869
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
870
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
871
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
872
- "zip-slip:zip-slip.js:192:node-entry"
873
- ]
874
- },
875
- {
876
- "timestamp": "2026-05-29T17:04:00.294Z",
877
- "label": "scan",
878
- "total": 21,
879
- "critical": 0,
880
- "high": 0,
881
- "medium": 2,
882
- "low": 19,
883
- "kev": 0,
884
- "ids": [
885
- "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
886
- "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
887
- "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
888
- "client-side:CLIENT_EVAL:client-side.js:135",
889
- "client-side:CLIENT_EVAL:client-side.js:139",
890
- "client-side:CLIENT_EVAL:client-side.js:140",
891
- "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
892
- "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
893
- "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
894
- "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
895
- "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
896
- "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
897
- "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
898
- "spec-drift:rate-limit-impl:rate-limit.js:34",
899
- "spec-drift:rate-limit-impl:rate-limit.js:77",
900
- "ssrf-meta-hardcoded:go-extended.js:39",
901
- "ssrf-meta-hardcoded:python-sinks.js:186",
902
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
903
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
904
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
905
- "zip-slip:zip-slip.js:192:node-entry"
906
- ]
907
- },
908
- {
909
- "timestamp": "2026-05-29T17:04:08.176Z",
910
- "label": "scan",
911
- "total": 21,
912
- "critical": 0,
913
- "high": 0,
914
- "medium": 2,
915
- "low": 19,
916
- "kev": 0,
917
- "ids": [
918
- "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
919
- "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
920
- "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
921
- "client-side:CLIENT_EVAL:client-side.js:135",
922
- "client-side:CLIENT_EVAL:client-side.js:139",
923
- "client-side:CLIENT_EVAL:client-side.js:140",
924
- "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
925
- "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
926
- "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
927
- "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
928
- "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
929
- "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
930
- "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
931
- "spec-drift:rate-limit-impl:rate-limit.js:34",
932
- "spec-drift:rate-limit-impl:rate-limit.js:77",
933
- "ssrf-meta-hardcoded:go-extended.js:39",
934
- "ssrf-meta-hardcoded:python-sinks.js:186",
935
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
936
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
937
- "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
938
- "zip-slip:zip-slip.js:192:node-entry"
939
- ]
940
- }
941
- ]