@clear-capabilities/agentic-security-scanner 0.118.2 → 0.119.2

package/src/.agentic-security/threat-model.md

@@ -1,118 +0,0 @@
-# Threat Model (auto-generated)
-
-Generated by agentic-security on 2026-06-01.
-
-This threat model is derived from static analysis of the current codebase and is regenerated on every scan. It is intended as a working artifact, not a finished compliance document.
-
-## Entities + boundaries
-
-```mermaid
-flowchart TB
-  subgraph External
-    route_GET__api_endpoint["http-route: GET /api/endpoint"]
-    route_GET__api_users_2["http-route: GET /api/users/2"]
-    route_GET__api_admin_users["http-route: GET /api/admin/users"]
-    route_GET__api_health["http-route: GET /api/health"]
-    route_GET___________________________________________________["http-route: GET                                                                                                                                   
-      parser: "]
-    queue_sast_sensitive_data_logging_js_67["queue-consumer:  sast/sensitive-data-logging.js:67"]
-  end
-  subgraph Application
-  end
-  External --> route_GET__api_endpoint
-  External --> route_GET__api_users_2
-  External --> route_GET__api_admin_users
-  External --> route_GET__api_health
-  External --> route_GET___________________________________________________
-  External --> queue_sast_sensitive_data_logging_js_67
-```
-
-## Assets
-
-
-## STRIDE threats
-
-### Information Disclosure (27)
-
-- [medium] **ssrf** (CWE-918) at `poc-video.js:98` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `posture/attack-playbooks.js:72` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **crypto-weak-cipher** (CWE-327) at `sast/crypto-protocol.js:141` — Weak symmetric cipher in use (DES / 3DES / RC4 / Blowfish / NULL / EXPORT)
-- [low] **crypto-weak-cipher** (CWE-327) at `sast/crypto-protocol.js:143` — Weak symmetric cipher in use (DES / 3DES / RC4 / Blowfish / NULL / EXPORT)
-- [low] **crypto-weak-cipher** (CWE-327) at `sast/crypto-protocol.js:145` — Weak symmetric cipher in use (DES / 3DES / RC4 / Blowfish / NULL / EXPORT)
-- [low] **crypto-weak-cipher** (CWE-327) at `sast/crypto-protocol.js:149` — Weak symmetric cipher in use (DES / 3DES / RC4 / Blowfish / NULL / EXPORT)
-- [low] **pqc-migration** (CWE-327) at `sast/post-quantum-crypto.js:136` — Pre-quantum RSA (rsa-encrypt) — replace with ML-KEM-768 before CRQC arrives
-- [low] **zip-slip** (CWE-22) at `sast/zip-slip.js:192` — Zip Slip: archive entry.path written to filesystem without sanitization
-- [low] **ssrf** (CWE-918) at `pr-comment.js:41` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `dataflow/catalog.js:547` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `dataflow/exploit-prover.js:33` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **crypto-weak-hash** (CWE-327) at `ir/parser-py.helper.py:68` — Weak hash algorithm (MD5 / SHA-1 / MD2 / MD4) used
-- [low] **ssrf** (CWE-918) at `posture/defender-agent.js:41` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `posture/flow-narration.js:24` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **pqc-migration** (CWE-327) at `posture/rule-pack-signing.js:187` — Pre-quantum ED25519 (ed25519) — replace with ML-DSA-65 before CRQC arrives
-- [low] **ssrf** (CWE-918) at `posture/verifier.js:55` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `sast/csharp-structural.js:60` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `sast/go-extended.js:39` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `sast/java-structural.js:76` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `sast/js-framework-structural.js:69` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `sast/kotlin.js:136` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `sast/php.js:111` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `sast/python-sinks.js:186` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `sast/ssrf-cloud-metadata.js:61` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `sast/ssrf-cloud-metadata.js:86` — SSRF: explicit reference to cloud instance-metadata endpoint
-- … and 2 more
-
-### Elevation of Privilege (22)
-
-- [medium] **ssrf** (CWE-918) at `poc-video.js:98` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `posture/attack-playbooks.js:72` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **unsafe-deserialization-user-controlled-j** (CWE-502) at `sca/sigstore-verify.js:undefined` — Unsafe Deserialization (User-Controlled JSON)
-- [low] **prototype-pollution** (CWE-1321) at `posture/adversarial-self-test.js:60` — Prototype Pollution: Direct write to __proto__ / constructor.prototype
-- [low] **llm-app-security** (CWE-502) at `sast/llm-app.js:163` — Untrusted Model Load — model file loaded from a non-literal path
-- [low] **llm-app-security** (CWE-502) at `sast/model-load.js:45` — Untrusted Model Load — model file loaded from a non-literal path
-- [low] **ssrf** (CWE-918) at `pr-comment.js:41` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `dataflow/catalog.js:547` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `dataflow/exploit-prover.js:33` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `posture/defender-agent.js:41` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `posture/flow-narration.js:24` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `posture/verifier.js:55` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `sast/csharp-structural.js:60` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `sast/go-extended.js:39` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `sast/java-structural.js:76` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `sast/js-framework-structural.js:69` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `sast/kotlin.js:136` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `sast/php.js:111` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `sast/python-sinks.js:186` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `sast/ssrf-cloud-metadata.js:61` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `sast/ssrf-cloud-metadata.js:86` — SSRF: explicit reference to cloud instance-metadata endpoint
-- [low] **ssrf** (CWE-918) at `sast/ssrf-cloud-metadata.js:15` — SSRF: explicit reference to cloud instance-metadata endpoint
-
-### Tampering (236)
-
-- [medium] **dos-sync-io** (CWE-400) at `posture/deploy-platform.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **mass-assignment** (CWE-915) at `ir/parser-cs.js:undefined` — Mass Assignment (req.body Direct to Model)
-- [low] **mass-assignment** (CWE-915) at `ir/parser-go.js:undefined` — Mass Assignment (req.body Direct to Model)
-- [low] **mass-assignment** (CWE-915) at `ir/parser-kt.js:undefined` — Mass Assignment (req.body Direct to Model)
-- [low] **mass-assignment** (CWE-915) at `ir/parser-php.js:undefined` — Mass Assignment (req.body Direct to Model)
-- [low] **mass-assignment** (CWE-915) at `ir/parser-rb.js:undefined` — Mass Assignment (req.body Direct to Model)
-- [low] **mass-assignment** (CWE-915) at `posture/integrity.js:undefined` — Mass Assignment (req.body Direct to Model)
-- [low] **dos-sync-io** (CWE-400) at `badge.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `history-scan.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `leaderboard.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `dataflow/cross-service-taint.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `dataflow/ifds-precise.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `dataflow/incremental.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `integrations/index.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `integrations/tickets.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `ir/cpp-preprocessor.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `ir/type-stubs.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `llm-validator/consistency.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `llm-validator/index.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `mcp/audit.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `mcp/server.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `mcp/tools.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `posture/agents-memory.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `posture/api-contract.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- [low] **dos-sync-io** (CWE-400) at `posture/auditor-walkthrough.js:undefined` — Synchronous Blocking I/O (DoS Risk in Server Context)
-- … and 211 more
-
-## Attack trees

package/src/dataflow/.agentic-security/dpia.md

@@ -1,26 +0,0 @@
-# Data Protection Impact Assessment (DPIA)
-
-Generated by agentic-security scanner on 2026-05-31.
-
-This is an automated DPIA scaffold derived from static analysis.
-It must be reviewed and completed by a privacy officer before use.
-
-## Data classes identified
-
-## Privacy-related findings
-
-| Severity | File:Line | Class → Sink | Description |
-|---|---|---|---|
-
-## Regulatory framework mapping
-
-- **GDPR Art. 35** — DPIA required when processing is likely to result in high risk to data subjects.
-- **CCPA §1798.130** — Notice + access rights for collected personal information.
-
-## Reviewer checklist
-
-- [ ] Confirm each PII field's collection has a documented lawful basis
-- [ ] Confirm retention period for each class is documented
-- [ ] Confirm DSAR (data subject access request) workflow exists
-- [ ] Confirm encryption at rest + in transit for each class
-- [ ] Confirm logging of PII access for audit (where applicable)