@clear-capabilities/agentic-security-scanner 0.148.0 → 0.148.3

package/src/posture/compliance-frameworks/nist-800-171-r3.json

@@ -4,9 +4,12 @@
   "publisher": "NIST",
   "license": "public-domain (US Federal publication)",
   "url": "https://csrc.nist.gov/pubs/sp/800/171/r3/final",
+  "sourceDoi": "https://doi.org/10.6028/NIST.SP.800-171r3",
+  "sourcePdfSha256": "3e4631df8b5d61f40a6e542b52779ef30ddbbfff31e09214fa94ad6e6f5e6d08",
+  "sourceVerificationNote": "Verified 2026-09-07: the CSRC landing page URL resolves and states title \"Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations\", Rev. 3, published May 2024. The DOI resolves (302) to the PDF at nvlpubs.nist.gov, whose own embedded XMP metadata (pdfx:DOI, pdfx:Comments) confirms NIST.SP.800-171r3. sourcePdfSha256 is the SHA-256 of that exact downloaded PDF, so a future re-check can detect if NIST republishes under the same URL/DOI with different content. This does not verify the CSV control export against the PDF text control-by-control — see scripts/nist-800-171/README for that gap.",
   "note": "Control text is generated from docs/standards/NIST_SP_800_171r3_Controls.csv by scripts/nist-800-171/build-catalog.py. The codeTestable rating is THIS ENGINE'S judgment, not NIST's. Unlike the AI 600-1 workbook, the 800-171 export rates no control for testability. Ratings and their rationales live in scripts/nist-800-171/code-testability.json.",
   "scope": "FULL CATALOGUE — all 97 requirements of NIST SP 800-171 Rev. 3 are carried, deliberately including those this engine cannot assess, because omitting them would read as coverage. Automated evidence is PARTIAL and unevenly distributed: 16 requirements are rated code-testable, 38 partial, and 43 are organisational, physical or personnel controls NOT represented by any automated signal: all of Awareness and Training, Personnel Security and Physical Protection, and most of Incident Response, Maintenance and Media Protection. Those are forced to 'partial' with an explicit disclosure and can never read as satisfied. This is not a CMMC assessment and produces no SPRS score.",
-  "controlsDigest": "28e4a38c393e1457",
+  "controlsDigest": "927295dcd1594189",
   "controlCount": 97,
   "controls": [
     {
@@ -330,10 +333,8 @@
       "summary": "Protection of Audit Information: a. Protect audit information and audit logging tools from unauthorized access, modification, and deletion. b. Authorize access to management of audit logging functionality to only a subset of…",
       "codeTestable": "partial",
       "evidence": [
-        "Artifact(s) present: integrity."
-      ],
-      "mapsTo": [
-        "module:integrity"
+        "No automated signal in this engine — this tool can sign and verify its OWN scan output (module:integrity), but that evidences this scanner's integrity, not whether the SCANNED PROJECT protects its own audit logs from unauthorized access, modification or deletion. No detector here inspects the scanned codebase for log-signing, tamper-evident storage, or access controls on audit data. Removed after a second-review pass found the original mapping was a category error (self-referential: about this tool, not the target).",
+        "Reported as an engine gap: this requirement is code-observable in principle (a detector could look for tamper-evident logging libraries or access-controlled log stores in application code), but no detector here decides it."
       ]
     },
     {

package/src/posture/compliance-frameworks/nist-ai-600-1.json

@@ -4,8 +4,11 @@
   "publisher": "NIST",
   "license": "public-domain (US Federal publication)",
   "url": "https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf",
+  "sourceDoi": "https://doi.org/10.6028/NIST.AI.600-1",
+  "sourcePdfSha256": "6e73620ab6b64e90ef2c04bf0e0d6246185a2f4b1b13cab0df494496cff89b6a",
+  "sourceVerificationNote": "Verified 2026-09-07: the doi.org DOI resolves (302) to this exact url, and the downloaded PDF's own embedded XMP metadata (pdfx:Category, dc:title) confirms \"NIST AI 600-1\" / \"Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile\". sourcePdfSha256 is the SHA-256 of that exact downloaded PDF, so a future re-check can detect if NIST republishes under the same URL/DOI with different content.",
   "scope": "SELECTIVE SUBSET. 6 actions from the Generative AI Profile with a code-observable signal. The profile is far larger; governance, provenance and incident-response actions are organisational and are NOT represented here. The full control catalogue is built and gated separately by scripts/nist-compliance/build-catalog.py.",
-  "controlsDigest": "a6ad567713796b05",
+  "controlsDigest": "6e7cc01c5ba8ae22",
   "controlCount": 6,
   "controls": [
     {
@@ -84,11 +87,10 @@
       "summary": "Establish content provenance / authenticity controls.",
       "codeTestable": "partial",
       "evidence": [
-        "Sigstore provenance opt-in configured for model loads.",
-        "ATTRIBUTIONS.md generated."
+        "ATTRIBUTIONS.md generated.",
+        "Removed module:sigstore-verify after a second-review pass (adversarial premortem Q1, 2026-09-07): sigstore-attestations/ is never written anywhere in this codebase — see the identical removal note on hipaa-security-rule.json's §164.312(c) for the full reasoning (home-directory cache by design, fire-and-forget async producer, not a quick artifact-path fix). Content-provenance / authenticity controls for model loads remain only partially evidenced by this control's surviving module:license-attributions leg."
       ],
       "mapsTo": [
-        "module:sigstore-verify",
         "module:license-attributions"
       ]
     }

package/src/posture/compliance-frameworks/nist-csf-2.json

@@ -4,8 +4,10 @@
   "publisher": "NIST",
   "license": "public-domain (US Federal publication)",
   "url": "https://www.nist.gov/cyberframework",
+  "sourceVerifiedAt": "2026-09-07",
+  "sourceVerificationNote": "Verified 2026-09-07 (WebFetch): confirmed NIST Cybersecurity Framework, CSF 2.0 stated as current throughout the page, matching this bundle. No content hash pinned: this is a resource hub page (quick-start guides, profiles, informative references, a downloadable PDF), not a single fixed document.",
   "scope": "SELECTIVE SUBSET. 8 subcategories with a code-observable signal. CSF 2.0 has over 100 subcategories; GOVERN in particular is organisational and is NOT represented here.",
-  "controlsDigest": "bcff46f53e75f501",
+  "controlsDigest": "1df76b5bde1d0044",
   "controlCount": 8,
   "controls": [
     {
@@ -45,12 +47,11 @@
       "summary": "Vulnerabilities and threats are identified.",
       "codeTestable": "partial",
       "evidence": [
-        "Regular scan history under .agentic-security/scan-history/.",
-        "ATT&CK / ATLAS technique mapping on findings."
+        "ATT&CK / ATLAS technique mapping on findings (last-scan.json).",
+        "Removed module:exploitability-probability (adversarial premortem Q2, 2026-09-07): that name is not in the ARTIFACT vocabulary table — exploitability-probability.js is a real, live annotator (posture/exploitability-probability.js), but it sets fields directly on findings in memory and writes no standalone artifact of its own; its output lands in last-scan.json, the exact file the surviving module:attack-taxonomy leg on this control already checks. This mapping could never read 'present' via this leg, on any project, since it shipped — removed rather than pointed at a duplicate check with no new signal."
       ],
       "mapsTo": [
-        "module:attack-taxonomy",
-        "module:exploitability-probability"
+        "module:attack-taxonomy"
       ]
     },
     {

package/src/posture/compliance-frameworks/nist-privacy-1-1.json

@@ -4,9 +4,9 @@
   "publisher": "NIST",
   "license": "public-domain (US Federal publication)",
   "url": "https://www.nist.gov/privacy-framework",
-  "note": "Each control carries NIST's own `codeTestable` rating (yes/partial/no). That rating says whether a control COULD be assessed from source code — it does not say this engine assesses it. `mapsTo` is present only where this engine produces a real signal; a control that NIST rates testable but which this engine cannot see is reported as an ENGINE GAP rather than silently passed.",
-  "scope": "FULL CATALOGUE, partially assessable. All 104 controls are present and each carries `codeTestable`. 48 are governance controls no scanner can assess; those report `manual`, never `satisfied`. See posture/privacy-framework.js.",
-  "controlsDigest": "447154af306c58d3",
+  "note": "Each control carries a `codeTestable` rating (yes/partial/no). This rating is HAND-AUTHORED BY THIS PROJECT, not NIST: the Privacy Framework document ships no machine-readable testability column (unlike NIST AI 600-1, whose source workbook has one, read by scripts/nist-compliance/build-catalog.py). The rating says whether a control COULD be assessed from source code, in this project's judgment, it does not say this engine assesses it, and it is not NIST's own claim. `mapsTo` is present only where this engine produces a real signal; a control rated testable but which this engine cannot see is reported as an ENGINE GAP rather than silently passed.",
+  "scope": "FULL CATALOGUE, partially assessable, transcribed from an Initial Public Draft (IPD) NOT yet finalized by NIST as of the last verification (see sourceVerificationNote). All 104 controls are present and each carries `codeTestable`, hand-authored by this project (see `note`), NOT a NIST-published rating. 48 are governance controls no scanner can assess; those report `manual`, never `satisfied`. See posture/privacy-framework.js.",
+  "controlsDigest": "3b91775abd5ffc1b",
   "controlCount": 104,
   "controls": [
     {
@@ -494,8 +494,11 @@
       "summary": "Log records are determined, documented, implemented, and reviewed in accordance with policy and incorporating the principle of data minimization.",
       "codeTestable": "partial",
       "mapsTo": [
-        "module:scan-history",
-        "module:mcp-audit"
+        "module:scan-history"
+      ],
+      "evidence": [
+        "Scan history retained.",
+        "Removed module:mcp-audit after a second-review pass: mcp-audit.log records calls to THIS tool's own MCP server, not the organisation's own log-record policy and review practice. Category error (self-referential: about this tool, not the target)."
       ]
     },
     {
@@ -605,8 +608,10 @@
       "category": "Data Processing Awareness (CM.AW-P)",
       "summary": "Records of data disclosures and sharing are maintained and can be accessed for review or transmission/disclosure.",
       "codeTestable": "yes",
-      "mapsTo": [
-        "module:mcp-audit"
+      "mapsTo": [],
+      "evidence": [
+        "No automated signal in this engine after a second-review pass removed the only prior mapping. module:mcp-audit pointed at THIS scanner's own MCP call log, not at the organisation's own records of data disclosures and sharing. Category error (self-referential: about this tool, not the target).",
+        "Reported as an engine gap: NIST rates this control code-testable (data-disclosure records could in principle be evidenced from a disclosure-log artifact in the scanned project), but no detector here looks for one."
       ]
     },
     {
@@ -623,8 +628,11 @@
       "summary": "Data provenance and lineage are maintained and can be accessed for review or transmission/disclosure.",
       "codeTestable": "partial",
       "mapsTo": [
-        "module:sbom-diff",
-        "module:integrity"
+        "module:sbom-diff"
+      ],
+      "evidence": [
+        "SBOM diff history retained.",
+        "Removed module:integrity after a second-review pass: last-scan.json.sig is this scanner signing its OWN scan output, not evidence of the organisation's own data provenance and lineage tracking. Category error (self-referential: about this tool, not the target), same class as the 03.03.08 fix in the NIST 800-171 framework."
       ]
     },
     {
@@ -845,5 +853,7 @@
       "summary": "Adequate resource capacity to ensure availability is maintained.",
       "codeTestable": "yes"
     }
-  ]
+  ],
+  "sourceVerifiedAt": "2026-09-07",
+  "sourceVerificationNote": "Verified 2026-09-07 (WebFetch, two independent prompts against https://www.nist.gov/privacy-framework): NIST Privacy Framework 1.1 is currently an Initial Public Draft (IPD), not a finalized standard, per the page's own \"PF 1.1 IPD\" labeling. Version 1.0 is NIST's current final release. This bundled framework's 104 controls were transcribed from the 1.1 IPD text; if NIST finalizes 1.1 with control-text or numbering changes, this file will not automatically reflect them and needs a re-check against the final publication when it ships. No sourcePdfSha256 is pinned because the source is a navigation hub page, not a single fixed document, and because a draft is expected to change before finalization, unlike a published SP."
 }

package/src/posture/compliance-frameworks/owasp-asvs-5.json

@@ -4,6 +4,8 @@
   "publisher": "OWASP Foundation",
   "license": "Creative Commons Attribution-ShareAlike 4.0",
   "url": "https://owasp.org/www-project-application-security-verification-standard/",
+  "sourceVerifiedAt": "2026-09-07",
+  "sourceVerificationNote": "Verified 2026-09-07 (WebFetch): confirmed OWASP ASVS, latest stable release listed as 5.0.0, matching this bundle (owasp-asvs-5), released at Global AppSec EU Barcelona 2025-05-30. No content hash pinned: this is a project navigation page linking to a versioned downloads page, not the standard itself.",
   "scope": "SELECTIVE SUBSET. 10 verification requirements with a direct detector behind them. ASVS 5.0 has several hundred requirements across 17 chapters; the remainder are NOT represented here.",
   "controlsDigest": "6c4371a08f010f91",
   "controlCount": 10,

package/src/posture/compliance-frameworks/owasp-llm-top-10.json

@@ -4,8 +4,11 @@
   "publisher": "OWASP Foundation",
   "license": "Creative Commons Attribution-ShareAlike 4.0",
   "url": "https://owasp.org/www-project-top-10-for-large-language-model-applications/",
-  "scope": "FULL TOP-10. All ten categories are present. Each category is a broad class rather than a single testable requirement, so a mapping indicates a detector exists for part of the class, not that the class is fully covered.",
-  "controlsDigest": "0a0351a9536790e4",
+  "sourceVerifiedAt": "2026-09-07",
+  "sourceVersionDriftDetected": true,
+  "sourceVerificationNote": "Verified 2026-09-07 (WebFetch): confirmed page is OWASP Top 10 for LLM Applications, but the CURRENT published edition is now 2026 (2026-08-04), not the 2025 edition this file bundles. See scope field for the disclosure and what remediation this requires.",
+  "scope": "FULL TOP-10. All ten categories are present. Each category is a broad class rather than a single testable requirement, so a mapping indicates a detector exists for part of the class, not that the class is fully covered. VERSION DRIFT, disclosed 2026-09-07: this bundle is the 2025 edition. OWASP published a 2026 edition on 2026-08-04 (confirmed live, the project page now archives 2025 and lists 2026 as current); the 10-category taxonomy may have changed. This file has NOT been re-mapped to the 2026 edition, that requires a deliberate review of the new categories against this engine's detector families, not a rushed relabel. Treat this bundle as 2025-accurate only until that review lands.",
+  "controlsDigest": "7500b9c4268eba6f",
   "controlCount": 10,
   "controls": [
     {
@@ -101,11 +104,10 @@
       "summary": "Excessive Agency — agent autonomy is bounded by explicit guards.",
       "codeTestable": "partial",
       "evidence": [
-        "MCP server config limits write-tools to confirm:true + reserved-write-path refusal.",
-        "Apply-fix path requires HMAC-verified scan."
+        "Apply-fix path requires HMAC-verified scan.",
+        "Removed module:mcp-tools after a second-review pass: that path points at THIS scanner's own source file (scanner/src/mcp/tools.js), which only resolves inside this tool's own checkout, never inside an arbitrary assessed project. It cannot evidence that the assessed LLM application bounds ITS OWN agent's autonomy. Category error (self-referential: about this tool, not the target)."
       ],
       "mapsTo": [
-        "module:mcp-tools",
         "module:apply-fix"
       ]
     },
@@ -114,13 +116,10 @@
       "summary": "Overreliance — human review checkpoints exist.",
       "codeTestable": "partial",
       "evidence": [
-        "security-fixer agent has Stop-on-verify-fail loop.",
-        "PreToolUse bodyguard exists."
+        "No automated signal in this engine after a second-review pass removed both prior mappings. module:security-fixer pointed at THIS scanner's own agent definition file (agents/security-fixer.md) and module:pre-edit-bodyguard at THIS scanner's own installed hook — both resolve only inside this tool's own checkout/plugin install, never inside an arbitrary assessed project, and neither evidences that the assessed LLM application itself has human review checkpoints. Category error (self-referential: about this tool, not the target), same class as the 03.03.08 fix in the NIST 800-171 framework.",
+        "Reported as an engine gap: human review checkpoints around an LLM application's outputs are code-observable in principle (an approval-gate library, a human-in-the-loop wrapper in the assessed system's own code), but no detector here looks for that in the SCANNED project."
       ],
-      "mapsTo": [
-        "module:security-fixer",
-        "module:pre-edit-bodyguard"
-      ]
+      "mapsTo": []
     },
     {
       "id": "LLM10",

package/src/posture/threat-model.js

@@ -32,7 +32,13 @@ const ASSET_PATTERNS = [
   // [regex, category, exposure]
   [/(?:stripe|paddle|braintree)\.\w+\.create/g, 'payment-method', 'public-api'],
   [/(?:User|users?)\.create\(|prisma\.user\.create/g, 'identity', 'public-api'],
-  [/(?:session|token|jwt)\s*=\s*/g, 'session', 'internal'],
+  // Real customer false positive: `session = requests.Session()` matched —
+  // the pattern only checked the LHS identifier, so an HTTP CLIENT object
+  // (requests.Session / aiohttp.ClientSession / httpx.Client) got reported
+  // as an "authenticated user session" asset. The negative lookahead
+  // excludes the specific RHS constructor shapes that mean "this is an
+  // outbound HTTP client", not "this holds a logged-in user's session".
+  [/(?:session|token|jwt)\s*=\s*(?!\s*(?:requests\.Session|aiohttp\.ClientSession|httpx\.(?:Client|AsyncClient))\s*\()/g, 'session', 'internal'],
   [/process\.env\.([A-Z_]+(?:KEY|SECRET|TOKEN))/g, 'secret', 'internal'],
   [/(?:aws-sdk|@aws-sdk).*\.upload|s3\.put/g, 'object-storage', 'public-api'],
   [/(?:openai|anthropic|together|groq)\.(?:chat|messages|completions)/g, 'llm-egress', 'external-api'],
@@ -43,8 +49,19 @@ const TRUST_BOUNDARY_PATTERNS = [
   [/router\.(?:get|post|put|patch|delete)\s*\(\s*['"`]([^'"`]+)['"`]/g, 'http-route'],
   [/@(?:Get|Post|Put|Patch|Delete)Mapping\s*\(/g, 'http-route-java'],
   [/@(?:app|router)\.(?:get|post|put|patch|delete)\s*\(\s*['"`]([^'"`]+)['"`]/g, 'http-route-py'],
-  [/(?:kafka|pubsub|sqs|sns)\.consume|\.subscribe|\.receiveMessage/gi, 'queue-consumer'],
-  [/(?:kafka|pubsub|sqs|sns)\.produce|\.publish|\.sendMessage/gi, 'queue-producer'],
+  // Real customer false positive: alternation without a shared group scopes
+  // ONLY the first branch to a queue library — `(?:kafka|pubsub|sqs|sns)\.produce
+  // |\.publish|\.sendMessage` is three TOP-LEVEL alternatives, and the last
+  // two are bare, unscoped substrings. `bundle.publisher_domain` and
+  // `bundle.published_at` both contain the literal substring ".publish" (the
+  // first 8 characters of "publisher"/"published"), so plain field access
+  // with no queue library, and no method call at all, was read as a
+  // queue-producer trust boundary. Moving the method-name alternation
+  // INSIDE the shared `(?:kafka|pubsub|sqs|sns)\.` prefix scopes every
+  // branch to an actual queue client, and requiring a trailing `(` excludes
+  // attribute access from matching a call-shaped rule.
+  [/(?:kafka|pubsub|sqs|sns)\.(?:consume|subscribe|receiveMessage)\s*\(/gi, 'queue-consumer'],
+  [/(?:kafka|pubsub|sqs|sns)\.(?:produce|publish|sendMessage)\s*\(/gi, 'queue-producer'],
   [/grpc\.Server|new\s+Server\s*\(\s*\)/g, 'grpc-server'],
   [/(?:db|pool|client)\.(?:query|execute|raw)\s*\(/g, 'db-edge'],
 ];

package/src/posture/verifier.js

@@ -32,6 +32,7 @@ import * as path from 'node:path';
 import * as os from 'node:os';
 import { runConfined, sandboxAvailable } from '../sandbox/index.js';
 import { isExplicitlyNoPoc } from './poc-cwe-map.js';
+import { isSafeStateDir, stateDir, statePath, stateWritesEnabled } from './state-dir.js';
 
 // ─── PoC static validation ──────────────────────────────────────────────────
 //
@@ -228,5 +229,74 @@ export function verifierCoverageSummary(findings) {
   return out;
 }
 
+// ─── Run persistence (adversarial premortem Q1, 2026-09-07) ────────────────
+//
+// `compliance-frameworks/*.json` has mapped `module:verifier` to
+// `verifier-runs/` since this framework's control-to-artifact table was
+// written, but nothing ever wrote to it: `cmdVerify` (bin/agentic-security.js)
+// ran the loop and printed a summary, but never persisted one. That made
+// NIST 800-171 `03.12.01` (Security Assessment) and NIST CSF 2.0 `RC.RP`
+// (Recovery plans executed and improved) permanently unable to read
+// 'present' via this leg of their mapping, on any project, ever — worse than
+// a self-referential mapping (which can at least clear, dishonestly), a
+// mapping that can never clear at all. This closes that gap for real, one
+// record per `agentic-security verify` run, same shape as fix-metrics.js's
+// append-per-attempt pattern (that file uses one growing JSONL; this one
+// uses one file per run, because the table entry it satisfies is a
+// directory, not a file, and a per-run file is what a reader would expect
+// under a name like "verifier-runs/").
+const RUN_DIR = 'verifier-runs';
+
+/**
+ * Persist one record of an `agentic-security verify` invocation. Best-effort
+ * and silent on failure, same convention as every other posture writer: a
+ * verify run's own findings must never be lost because the record of having
+ * run could not be written.
+ *
+ * @returns {boolean} whether the record was written (for tests, not callers).
+ */
+export function recordVerifierRun(scanRoot, summary) {
+  if (!scanRoot || !summary || typeof summary !== 'object') return false;
+  try {
+    const dir = stateDir(scanRoot);
+    if (!isSafeStateDir(dir)) return false;
+    if (!stateWritesEnabled()) return false;
+    const runsDir = statePath(scanRoot, RUN_DIR);
+    fs.mkdirSync(runsDir, { recursive: true });
+    const now = new Date();
+    // Millisecond Date timestamps collide under back-to-back calls (two
+    // `verify` invocations in the same test, or a scripted loop). hrtime is
+    // monotonic and nanosecond-resolution within this process, so appending
+    // it guarantees both a distinct filename AND correct chronological sort
+    // order (alphabetical == call order), which a random suffix alone would
+    // not: two records written in the same millisecond would sort by random
+    // bytes, not by which call happened first.
+    const stamp = now.toISOString().replace(/[^0-9TZ]/g, '-');
+    const seq = process.hrtime.bigint().toString().padStart(20, '0');
+    const record = { timestamp: now.toISOString(), ...summary };
+    // One writeFileSync of one complete file: a concurrent reader sees a
+    // whole record or nothing (never a partial one, unlike an append target).
+    fs.writeFileSync(path.join(runsDir, `${stamp}-${seq}.json`), JSON.stringify(record, null, 2), 'utf8');
+    return true;
+  } catch { return false; }
+}
+
+/**
+ * Read every well-formed run record, oldest first. A file that does not
+ * parse is skipped, not thrown on — same tolerant-read convention as
+ * fix-metrics.js's readFixAttempts.
+ */
+export function readVerifierRuns(scanRoot) {
+  try {
+    const runsDir = statePath(scanRoot, RUN_DIR);
+    const files = fs.readdirSync(runsDir).filter((f) => f.endsWith('.json')).sort();
+    const out = [];
+    for (const f of files) {
+      try { out.push(JSON.parse(fs.readFileSync(path.join(runsDir, f), 'utf8'))); } catch { /* skip malformed */ }
+    }
+    return out;
+  } catch { return []; }
+}
+
 // For tests and the no-dead-modules check.
 export const _internals = { MAX_POC_BYTES, BANNED_HOSTS, SANITIZER_TABLE, runSandboxed };

package/src/sast/python-sinks.js

@@ -41,7 +41,30 @@ const SQLA_RAW_EXEC_CONCAT_RE = /\b(?:cursor|conn|connection|session)\s*\.\s*exe
 // quotes (single quotes inside double-quoted f-string and vice versa) so we
 // use two parallel patterns rather than a single character class that excludes
 // both quote kinds.
-const SQLA_FSTRING_SQL_ASSIGN_RE = /(?:f"[^"]*(?:SELECT|INSERT|UPDATE|DELETE)[^"]*\{[^}]*\}|f'[^']*(?:SELECT|INSERT|UPDATE|DELETE)[^']*\{[^}]*\})/gi;
+//
+// Two real-world false positives, both from the same underlying defect —
+// this regex checked for a co-occurring keyword-shaped substring and a `{}`
+// interpolation, not an actual SQL statement being assigned:
+//
+//   query = f"SELECT * FROM users WHERE id = {user_id}"   -> should fire
+//   print(f"[{position}] {len(selected)} readable pages")  -> was firing
+//   raise RuntimeError(f"Selected TAR members exceed {N} bytes")  -> was firing
+//
+// Case-insensitive matching with no word boundary let the SQL keyword
+// alternation match inside ordinary English/identifier text — "Select" is
+// the first six letters of "Selected", and "select" is the first six of the
+// variable name "selected". `\b...\b` fixes that: a word boundary requires a
+// non-word/word transition, which does not exist between "Select" and the
+// trailing "ed" (both are word characters), so "Selected"/"selected" no
+// longer match while "SELECT"/"select" as complete tokens still do.
+//
+// The vuln title claims "f-string SQL ASSIGNED TO VARIABLE", but the regex
+// never actually checked for an assignment — it fired on any f-string
+// anywhere, including a bare argument to print()/raise. Requiring
+// `IDENT = ` (optionally through an opening paren, for a wrapped assignment)
+// immediately before the f-string makes the check match what its own name
+// promises, and excludes the print()/raise-message shape entirely.
+const SQLA_FSTRING_SQL_ASSIGN_RE = /\b[A-Za-z_]\w*\s*=\s*\(?\s*(?:f"[^"]*\b(?:SELECT|INSERT|UPDATE|DELETE)\b[^"]*\{[^}]*\}|f'[^']*\b(?:SELECT|INSERT|UPDATE|DELETE)\b[^']*\{[^}]*\})/gi;
 
 // ─── Command injection ────────────────────────────────────────────────────
 //