@clear-capabilities/agentic-security-scanner 0.118.2 → 0.119.1

package/src/sast/.agentic-security/threat-model.md

@@ -1,91 +0,0 @@
-# Threat Model (auto-generated)
-
-Generated by agentic-security on 2026-06-01.
-
-This threat model is derived from static analysis of the current codebase and is regenerated on every scan. It is intended as a working artifact, not a finished compliance document.
-
-## Entities + boundaries
-
-```mermaid
-flowchart TB
-  subgraph External
-    route_GET___________________________________________________["http-route: GET                                                                                                                                   
-      parser: "]
-    queue_sensitive_data_logging_js_67["queue-consumer:  sensitive-data-logging.js:67"]
-  end
-  subgraph Application
-  end
-  External --> route_GET___________________________________________________
-  External --> queue_sensitive_data_logging_js_67
-```
-
-## Assets
-
-
-## STRIDE threats
-
-### Tampering (31)
-
-- [medium] **crypto-tls-no-verify** (CWE-295) at `crypto-protocol.js:105` — TLS certificate verification disabled — MITM-vulnerable
-- [medium] **crypto-tls-no-verify** (CWE-295) at `crypto-protocol.js:108` — TLS certificate verification disabled — MITM-vulnerable
-- [medium] **crypto-tls-no-verify** (CWE-295) at `crypto-protocol.js:114` — TLS certificate verification disabled — MITM-vulnerable
-- [medium] **crypto-tls-no-verify** (CWE-295) at `crypto-protocol.js:116` — TLS certificate verification disabled — MITM-vulnerable
-- [medium] **crypto-tls-no-verify** (CWE-295) at `crypto-protocol.js:118` — TLS certificate verification disabled — MITM-vulnerable
-- [medium] **eth-sign-used** (CWE-345) at `dapp-frontend.js:74` — eth_sign — signs arbitrary 32-byte hash with no prefix (the "death sign")
-- [medium] **spec-drift** (CWE-770) at `rate-limit.js:34` — Spec drift — _hasRateLimit() claims rate-limit-impl but body lacks expected evidence
-- [medium] **spec-drift** (CWE-770) at `rate-limit.js:77` — Spec drift — scanRateLimit() claims rate-limit-impl but body lacks expected evidence
-- [low] **idor** (CWE-347) at `authz.js:33` — AuthZ: jwt.verify called without algorithms allow-list
-- [low] **cache-poisoning** (CWE-349) at `cache-poisoning.js:20` — Cache Poisoning — X-Forwarded-Host reflected from request to response
-- [low] **client-side-eval-with-dynamic-input** (CWE-95) at `client-side.js:135` — Client-Side — eval with Dynamic Input
-- [low] **client-side-eval-with-dynamic-input** (CWE-95) at `client-side.js:139` — Client-Side — eval with Dynamic Input
-- [low] **client-side-eval-with-dynamic-input** (CWE-95) at `client-side.js:140` — Client-Side — eval with Dynamic Input
-- [low] **idor** (CWE-347) at `crypto-protocol.js:374` — AuthZ: jwt.verify called without algorithms allow-list
-- [low] **idor** (CWE-347) at `crypto-protocol.js:375` — AuthZ: jwt.verify called without algorithms allow-list
-- [low] **crypto-tls-version** (CWE-326) at `crypto-protocol.js:67` — TLS configured to accept versions below TLS 1.2
-- [low] **crypto-tls-version** (CWE-326) at `crypto-protocol.js:69` — TLS configured to accept versions below TLS 1.2
-- [low] **crypto-jwt-key-confusion** (CWE-345) at `crypto-protocol.js:374` — jwt.verify called without algorithms allowlist — algorithm-confusion attack
-- [low] **prompt-template-user-input-interpolated-** (CWE-1336) at `k8s-admission.js:139` — Prompt Template: user input interpolated into prompt string without isolation
-- [low] **llm-app-security** (CWE-1427) at `llm-app.js:93` — Prompt Injection — system prompt concatenated with user input
-- [low] **llm-app-security** (CWE-1427) at `llm-app.js:136` — RAG Injection — vector-store result flows into LLM prompt without sanitization
-- [low] **llm-app-security** (CWE-1427) at `llm-app.js:137` — RAG Injection — vector-store result flows into LLM prompt without sanitization
-- [low] **prompt-injection-system-prompt-built-fro** (CWE-1427) at `llm-owasp.js:180` — Prompt Injection — system prompt built from concatenated/interpolated content (LLM01)
-- [low] **prompt-injection-system-prompt-built-fro** (CWE-1427) at `llm-owasp.js:181` — Prompt Injection — system prompt built from concatenated/interpolated content (LLM01)
-- [low] **prompt-injection-system-prompt-built-fro** (CWE-1427) at `llm-owasp.js:182` — Prompt Injection — system prompt built from concatenated/interpolated content (LLM01)
-- … and 6 more
-
-### Information Disclosure (17)
-
-- [low] **crypto-weak-cipher** (CWE-327) at `crypto-protocol.js:141` — Weak symmetric cipher in use (DES / 3DES / RC4 / Blowfish / NULL / EXPORT)
-- [low] **crypto-weak-cipher** (CWE-327) at `crypto-protocol.js:143` — Weak symmetric cipher in use (DES / 3DES / RC4 / Blowfish / NULL / EXPORT)
-- [low] **crypto-weak-cipher** (CWE-327) at `crypto-protocol.js:145` — Weak symmetric cipher in use (DES / 3DES / RC4 / Blowfish / NULL / EXPORT)
-- [low] **crypto-weak-cipher** (CWE-327) at `crypto-protocol.js:149` — Weak symmetric cipher in use (DES / 3DES / RC4 / Blowfish / NULL / EXPORT)
-- [low] **pqc-migration** (CWE-327) at `post-quantum-crypto.js:136` — Pre-quantum RSA (rsa-encrypt) — replace with ML-KEM-768 before CRQC arrives
-- [low] **zip-slip** (CWE-22) at `zip-slip.js:192` — Zip Slip: archive entry.path written to filesystem without sanitization
-- [low] **ssrf** (CWE-918) at `csharp-structural.js:60` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `go-extended.js:39` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `java-structural.js:76` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `js-framework-structural.js:69` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `kotlin.js:136` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `php.js:111` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `python-sinks.js:186` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `ssrf-cloud-metadata.js:61` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `ssrf-cloud-metadata.js:86` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `ssrf-cloud-metadata.js:15` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **crypto-weak-hash** (CWE-327) at `weak-password-hash.js:45` — Weak hash algorithm (MD5 / SHA-1 / MD2 / MD4) used
-
-### Elevation of Privilege (12)
-
-- [low] **llm-app-security** (CWE-502) at `llm-app.js:163` — Untrusted Model Load — model file loaded from a non-literal path
-- [low] **llm-app-security** (CWE-502) at `model-load.js:45` — Untrusted Model Load — model file loaded from a non-literal path
-- [low] **ssrf** (CWE-918) at `csharp-structural.js:60` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `go-extended.js:39` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `java-structural.js:76` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `js-framework-structural.js:69` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `kotlin.js:136` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `php.js:111` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `python-sinks.js:186` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `ssrf-cloud-metadata.js:61` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `ssrf-cloud-metadata.js:86` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `ssrf-cloud-metadata.js:15` — SSRF: explicit reference to cloud instance-metadata endpoint
-
-## Attack trees