@clear-capabilities/agentic-security-scanner 0.118.2 → 0.119.1

package/src/sast/.agentic-security/threat-model.json

@@ -1,816 +0,0 @@
-{
-  "entities": [
-    {
-      "kind": "http-route",
-      "id": "route:GET:                                                                                                                                  \n      parser: ",
-      "method": "GET",
-      "path": "                                                                                                                                  \n      parser: ",
-      "file": "xpath-injection.js",
-      "line": 69,
-      "requiresAuth": false
-    },
-    {
-      "kind": "queue-consumer",
-      "id": "queue:sensitive-data-logging.js:67",
-      "file": "sensitive-data-logging.js",
-      "line": 67
-    }
-  ],
-  "boundaries": [
-    {
-      "from": "external",
-      "to": "route:GET:                                                                                                                                  \n      parser: ",
-      "kind": "trust-boundary",
-      "requiresAuth": false
-    },
-    {
-      "from": "external",
-      "to": "queue:sensitive-data-logging.js:67",
-      "kind": "trust-boundary"
-    }
-  ],
-  "assets": [],
-  "threats": [
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-295",
-      "family": "crypto-tls-no-verify",
-      "severity": "medium",
-      "file": "crypto-protocol.js",
-      "line": 105,
-      "vuln": "TLS certificate verification disabled — MITM-vulnerable",
-      "finding_id": "crypto-tls-no-verify:crypto-protocol.js:105",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-295",
-      "family": "crypto-tls-no-verify",
-      "severity": "medium",
-      "file": "crypto-protocol.js",
-      "line": 108,
-      "vuln": "TLS certificate verification disabled — MITM-vulnerable",
-      "finding_id": "crypto-tls-no-verify:crypto-protocol.js:108",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-295",
-      "family": "crypto-tls-no-verify",
-      "severity": "medium",
-      "file": "crypto-protocol.js",
-      "line": 114,
-      "vuln": "TLS certificate verification disabled — MITM-vulnerable",
-      "finding_id": "crypto-tls-no-verify:crypto-protocol.js:114",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-295",
-      "family": "crypto-tls-no-verify",
-      "severity": "medium",
-      "file": "crypto-protocol.js",
-      "line": 116,
-      "vuln": "TLS certificate verification disabled — MITM-vulnerable",
-      "finding_id": "crypto-tls-no-verify:crypto-protocol.js:116",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-295",
-      "family": "crypto-tls-no-verify",
-      "severity": "medium",
-      "file": "crypto-protocol.js",
-      "line": 118,
-      "vuln": "TLS certificate verification disabled — MITM-vulnerable",
-      "finding_id": "crypto-tls-no-verify:crypto-protocol.js:118",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-345",
-      "family": "eth-sign-used",
-      "severity": "medium",
-      "file": "dapp-frontend.js",
-      "line": 74,
-      "vuln": "eth_sign — signs arbitrary 32-byte hash with no prefix (the \"death sign\")",
-      "finding_id": "dapp-eth-sign:dapp-frontend.js:74",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-770",
-      "family": "spec-drift",
-      "severity": "medium",
-      "file": "rate-limit.js",
-      "line": 34,
-      "vuln": "Spec drift — _hasRateLimit() claims rate-limit-impl but body lacks expected evidence",
-      "finding_id": "spec-drift:rate-limit-impl:rate-limit.js:34",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-770",
-      "family": "spec-drift",
-      "severity": "medium",
-      "file": "rate-limit.js",
-      "line": 77,
-      "vuln": "Spec drift — scanRateLimit() claims rate-limit-impl but body lacks expected evidence",
-      "finding_id": "spec-drift:rate-limit-impl:rate-limit.js:77",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-347",
-      "family": "idor",
-      "severity": "low",
-      "file": "authz.js",
-      "line": 33,
-      "vuln": "AuthZ: jwt.verify called without algorithms allow-list",
-      "finding_id": "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-349",
-      "family": "cache-poisoning",
-      "severity": "low",
-      "file": "cache-poisoning.js",
-      "line": 20,
-      "vuln": "Cache Poisoning — X-Forwarded-Host reflected from request to response",
-      "finding_id": "cache-poison-reflect:cache-poisoning.js:20",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-95",
-      "family": "client-side-eval-with-dynamic-input",
-      "severity": "low",
-      "file": "client-side.js",
-      "line": 135,
-      "vuln": "Client-Side — eval with Dynamic Input",
-      "finding_id": "client-side:CLIENT_EVAL:client-side.js:135",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-95",
-      "family": "client-side-eval-with-dynamic-input",
-      "severity": "low",
-      "file": "client-side.js",
-      "line": 139,
-      "vuln": "Client-Side — eval with Dynamic Input",
-      "finding_id": "client-side:CLIENT_EVAL:client-side.js:139",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-95",
-      "family": "client-side-eval-with-dynamic-input",
-      "severity": "low",
-      "file": "client-side.js",
-      "line": 140,
-      "vuln": "Client-Side — eval with Dynamic Input",
-      "finding_id": "client-side:CLIENT_EVAL:client-side.js:140",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-347",
-      "family": "idor",
-      "severity": "low",
-      "file": "crypto-protocol.js",
-      "line": 374,
-      "vuln": "AuthZ: jwt.verify called without algorithms allow-list",
-      "finding_id": "authz:crypto-protocol.js:374:AuthZ__jwt_verify_called_without_algorithms_allow_list",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-347",
-      "family": "idor",
-      "severity": "low",
-      "file": "crypto-protocol.js",
-      "line": 375,
-      "vuln": "AuthZ: jwt.verify called without algorithms allow-list",
-      "finding_id": "authz:crypto-protocol.js:375:AuthZ__jwt_verify_called_without_algorithms_allow_list",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-326",
-      "family": "crypto-tls-version",
-      "severity": "low",
-      "file": "crypto-protocol.js",
-      "line": 67,
-      "vuln": "TLS configured to accept versions below TLS 1.2",
-      "finding_id": "crypto-tls-min-version:crypto-protocol.js:67",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-326",
-      "family": "crypto-tls-version",
-      "severity": "low",
-      "file": "crypto-protocol.js",
-      "line": 69,
-      "vuln": "TLS configured to accept versions below TLS 1.2",
-      "finding_id": "crypto-tls-min-version:crypto-protocol.js:69",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "I",
-      "strideLabel": "Information Disclosure",
-      "cwe": "CWE-327",
-      "family": "crypto-weak-cipher",
-      "severity": "low",
-      "file": "crypto-protocol.js",
-      "line": 141,
-      "vuln": "Weak symmetric cipher in use (DES / 3DES / RC4 / Blowfish / NULL / EXPORT)",
-      "finding_id": "crypto-weak-cipher:crypto-protocol.js:141",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "I",
-      "strideLabel": "Information Disclosure",
-      "cwe": "CWE-327",
-      "family": "crypto-weak-cipher",
-      "severity": "low",
-      "file": "crypto-protocol.js",
-      "line": 143,
-      "vuln": "Weak symmetric cipher in use (DES / 3DES / RC4 / Blowfish / NULL / EXPORT)",
-      "finding_id": "crypto-weak-cipher:crypto-protocol.js:143",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "I",
-      "strideLabel": "Information Disclosure",
-      "cwe": "CWE-327",
-      "family": "crypto-weak-cipher",
-      "severity": "low",
-      "file": "crypto-protocol.js",
-      "line": 145,
-      "vuln": "Weak symmetric cipher in use (DES / 3DES / RC4 / Blowfish / NULL / EXPORT)",
-      "finding_id": "crypto-weak-cipher:crypto-protocol.js:145",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "I",
-      "strideLabel": "Information Disclosure",
-      "cwe": "CWE-327",
-      "family": "crypto-weak-cipher",
-      "severity": "low",
-      "file": "crypto-protocol.js",
-      "line": 149,
-      "vuln": "Weak symmetric cipher in use (DES / 3DES / RC4 / Blowfish / NULL / EXPORT)",
-      "finding_id": "crypto-weak-cipher:crypto-protocol.js:149",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-345",
-      "family": "crypto-jwt-key-confusion",
-      "severity": "low",
-      "file": "crypto-protocol.js",
-      "line": 374,
-      "vuln": "jwt.verify called without algorithms allowlist — algorithm-confusion attack",
-      "finding_id": "crypto-jwt-no-algs-allowlist:crypto-protocol.js:374",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-1336",
-      "family": "prompt-template-user-input-interpolated-",
-      "severity": "low",
-      "file": "k8s-admission.js",
-      "line": 139,
-      "vuln": "Prompt Template: user input interpolated into prompt string without isolation",
-      "finding_id": "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-1427",
-      "family": "llm-app-security",
-      "severity": "low",
-      "file": "llm-app.js",
-      "line": 93,
-      "vuln": "Prompt Injection — system prompt concatenated with user input",
-      "finding_id": "llm-prompt-injection-mix:93",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-1427",
-      "family": "llm-app-security",
-      "severity": "low",
-      "file": "llm-app.js",
-      "line": 136,
-      "vuln": "RAG Injection — vector-store result flows into LLM prompt without sanitization",
-      "finding_id": "llm-rag-injection:136",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-1427",
-      "family": "llm-app-security",
-      "severity": "low",
-      "file": "llm-app.js",
-      "line": 137,
-      "vuln": "RAG Injection — vector-store result flows into LLM prompt without sanitization",
-      "finding_id": "llm-rag-injection:137",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "E",
-      "strideLabel": "Elevation of Privilege",
-      "cwe": "CWE-502",
-      "family": "llm-app-security",
-      "severity": "low",
-      "file": "llm-app.js",
-      "line": 163,
-      "vuln": "Untrusted Model Load — model file loaded from a non-literal path",
-      "finding_id": "llm-model-load-untrusted:163",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-1427",
-      "family": "prompt-injection-system-prompt-built-fro",
-      "severity": "low",
-      "file": "llm-owasp.js",
-      "line": 180,
-      "vuln": "Prompt Injection — system prompt built from concatenated/interpolated content (LLM01)",
-      "finding_id": "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-1427",
-      "family": "prompt-injection-system-prompt-built-fro",
-      "severity": "low",
-      "file": "llm-owasp.js",
-      "line": 181,
-      "vuln": "Prompt Injection — system prompt built from concatenated/interpolated content (LLM01)",
-      "finding_id": "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-1427",
-      "family": "prompt-injection-system-prompt-built-fro",
-      "severity": "low",
-      "file": "llm-owasp.js",
-      "line": 182,
-      "vuln": "Prompt Injection — system prompt built from concatenated/interpolated content (LLM01)",
-      "finding_id": "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-1336",
-      "family": "prompt-template-user-input-interpolated-",
-      "severity": "low",
-      "file": "llm-owasp.js",
-      "line": 125,
-      "vuln": "Prompt Template: user input interpolated into prompt string without isolation",
-      "finding_id": "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "E",
-      "strideLabel": "Elevation of Privilege",
-      "cwe": "CWE-502",
-      "family": "llm-app-security",
-      "severity": "low",
-      "file": "model-load.js",
-      "line": 45,
-      "vuln": "Untrusted Model Load — model file loaded from a non-literal path",
-      "finding_id": "llm-model-load-untrusted:45",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-79",
-      "family": "xss",
-      "severity": "low",
-      "file": "mutation-xss.js",
-      "line": 123,
-      "vuln": "Markdown→HTML XSS — user-supplied Markdown rendered to HTML without sanitization",
-      "finding_id": "markdown-xss:mutation-xss.js:123",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "I",
-      "strideLabel": "Information Disclosure",
-      "cwe": "CWE-327",
-      "family": "pqc-migration",
-      "severity": "low",
-      "file": "post-quantum-crypto.js",
-      "line": 136,
-      "vuln": "Pre-quantum RSA (rsa-encrypt) — replace with ML-KEM-768 before CRQC arrives",
-      "finding_id": "pqc-rsa-encrypt:post-quantum-crypto.js:136",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "I",
-      "strideLabel": "Information Disclosure",
-      "cwe": "CWE-22",
-      "family": "zip-slip",
-      "severity": "low",
-      "file": "zip-slip.js",
-      "line": 192,
-      "vuln": "Zip Slip: archive entry.path written to filesystem without sanitization",
-      "finding_id": "zip-slip:zip-slip.js:192:node-entry",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "I",
-      "strideLabel": "Information Disclosure",
-      "cwe": "CWE-918",
-      "family": "ssrf",
-      "severity": "low",
-      "file": "csharp-structural.js",
-      "line": 60,
-      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
-      "finding_id": "ssrf-meta-hardcoded:csharp-structural.js:60",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "E",
-      "strideLabel": "Elevation of Privilege",
-      "cwe": "CWE-918",
-      "family": "ssrf",
-      "severity": "low",
-      "file": "csharp-structural.js",
-      "line": 60,
-      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
-      "finding_id": "ssrf-meta-hardcoded:csharp-structural.js:60",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "I",
-      "strideLabel": "Information Disclosure",
-      "cwe": "CWE-918",
-      "family": "ssrf",
-      "severity": "low",
-      "file": "go-extended.js",
-      "line": 39,
-      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
-      "finding_id": "ssrf-meta-hardcoded:go-extended.js:39",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "E",
-      "strideLabel": "Elevation of Privilege",
-      "cwe": "CWE-918",
-      "family": "ssrf",
-      "severity": "low",
-      "file": "go-extended.js",
-      "line": 39,
-      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
-      "finding_id": "ssrf-meta-hardcoded:go-extended.js:39",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-644",
-      "family": "cache-poisoning",
-      "severity": "low",
-      "file": "host-header.js",
-      "line": 99,
-      "vuln": "Cache Poisoning — Host header used in URL/redirect generation",
-      "finding_id": "cache-poison-host:host-header.js:99",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "I",
-      "strideLabel": "Information Disclosure",
-      "cwe": "CWE-918",
-      "family": "ssrf",
-      "severity": "low",
-      "file": "java-structural.js",
-      "line": 76,
-      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
-      "finding_id": "ssrf-meta-hardcoded:java-structural.js:76",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "E",
-      "strideLabel": "Elevation of Privilege",
-      "cwe": "CWE-918",
-      "family": "ssrf",
-      "severity": "low",
-      "file": "java-structural.js",
-      "line": 76,
-      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
-      "finding_id": "ssrf-meta-hardcoded:java-structural.js:76",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "I",
-      "strideLabel": "Information Disclosure",
-      "cwe": "CWE-918",
-      "family": "ssrf",
-      "severity": "low",
-      "file": "js-framework-structural.js",
-      "line": 69,
-      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
-      "finding_id": "ssrf-meta-hardcoded:js-framework-structural.js:69",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "E",
-      "strideLabel": "Elevation of Privilege",
-      "cwe": "CWE-918",
-      "family": "ssrf",
-      "severity": "low",
-      "file": "js-framework-structural.js",
-      "line": 69,
-      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
-      "finding_id": "ssrf-meta-hardcoded:js-framework-structural.js:69",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "I",
-      "strideLabel": "Information Disclosure",
-      "cwe": "CWE-918",
-      "family": "ssrf",
-      "severity": "low",
-      "file": "kotlin.js",
-      "line": 136,
-      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
-      "finding_id": "ssrf-meta-hardcoded:kotlin.js:136",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "E",
-      "strideLabel": "Elevation of Privilege",
-      "cwe": "CWE-918",
-      "family": "ssrf",
-      "severity": "low",
-      "file": "kotlin.js",
-      "line": 136,
-      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
-      "finding_id": "ssrf-meta-hardcoded:kotlin.js:136",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-77",
-      "family": "system-prompt-missing-explicit-anti-inje",
-      "severity": "low",
-      "file": "llm-app.js",
-      "line": 104,
-      "vuln": "System prompt missing explicit anti-injection guidance — model may follow user-supplied \"ignore previous\" attacks",
-      "finding_id": "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-400",
-      "family": "unbounded-consumption-llm-call-has-no-to",
-      "severity": "low",
-      "file": "llm-owasp.js",
-      "line": 183,
-      "vuln": "Unbounded Consumption — LLM call has no token budget (LLM10)",
-      "finding_id": "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "I",
-      "strideLabel": "Information Disclosure",
-      "cwe": "CWE-918",
-      "family": "ssrf",
-      "severity": "low",
-      "file": "php.js",
-      "line": 111,
-      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
-      "finding_id": "ssrf-meta-hardcoded:php.js:111",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "E",
-      "strideLabel": "Elevation of Privilege",
-      "cwe": "CWE-918",
-      "family": "ssrf",
-      "severity": "low",
-      "file": "php.js",
-      "line": 111,
-      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
-      "finding_id": "ssrf-meta-hardcoded:php.js:111",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "I",
-      "strideLabel": "Information Disclosure",
-      "cwe": "CWE-918",
-      "family": "ssrf",
-      "severity": "low",
-      "file": "python-sinks.js",
-      "line": 186,
-      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
-      "finding_id": "ssrf-meta-hardcoded:python-sinks.js:186",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "E",
-      "strideLabel": "Elevation of Privilege",
-      "cwe": "CWE-918",
-      "family": "ssrf",
-      "severity": "low",
-      "file": "python-sinks.js",
-      "line": 186,
-      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
-      "finding_id": "ssrf-meta-hardcoded:python-sinks.js:186",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "T",
-      "strideLabel": "Tampering",
-      "cwe": "CWE-532",
-      "family": "sensitive-data-logging",
-      "severity": "low",
-      "file": "sensitive-data-logging.js",
-      "line": 67,
-      "vuln": "Sensitive Data Logged — PII-named variable sent to logger without sanitization",
-      "finding_id": "sensitive-log:sensitive-data-logging.js:67",
-      "affectsAsset": null,
-      "atEntity": "queue:sensitive-data-logging.js:67"
-    },
-    {
-      "stride": "I",
-      "strideLabel": "Information Disclosure",
-      "cwe": "CWE-918",
-      "family": "ssrf",
-      "severity": "low",
-      "file": "ssrf-cloud-metadata.js",
-      "line": 61,
-      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
-      "finding_id": "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:61",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "E",
-      "strideLabel": "Elevation of Privilege",
-      "cwe": "CWE-918",
-      "family": "ssrf",
-      "severity": "low",
-      "file": "ssrf-cloud-metadata.js",
-      "line": 61,
-      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
-      "finding_id": "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:61",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "I",
-      "strideLabel": "Information Disclosure",
-      "cwe": "CWE-918",
-      "family": "ssrf",
-      "severity": "low",
-      "file": "ssrf-cloud-metadata.js",
-      "line": 86,
-      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
-      "finding_id": "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:86",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "E",
-      "strideLabel": "Elevation of Privilege",
-      "cwe": "CWE-918",
-      "family": "ssrf",
-      "severity": "low",
-      "file": "ssrf-cloud-metadata.js",
-      "line": 86,
-      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
-      "finding_id": "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:86",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "I",
-      "strideLabel": "Information Disclosure",
-      "cwe": "CWE-918",
-      "family": "ssrf",
-      "severity": "low",
-      "file": "ssrf-cloud-metadata.js",
-      "line": 15,
-      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
-      "finding_id": "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "E",
-      "strideLabel": "Elevation of Privilege",
-      "cwe": "CWE-918",
-      "family": "ssrf",
-      "severity": "low",
-      "file": "ssrf-cloud-metadata.js",
-      "line": 15,
-      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
-      "finding_id": "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
-      "affectsAsset": null,
-      "atEntity": null
-    },
-    {
-      "stride": "I",
-      "strideLabel": "Information Disclosure",
-      "cwe": "CWE-327",
-      "family": "crypto-weak-hash",
-      "severity": "low",
-      "file": "weak-password-hash.js",
-      "line": 45,
-      "vuln": "Weak hash algorithm (MD5 / SHA-1 / MD2 / MD4) used",
-      "finding_id": "crypto-weak-hash:weak-password-hash.js:45",
-      "affectsAsset": null,
-      "atEntity": null
-    }
-  ],
-  "attackTrees": []
-}