@clear-capabilities/agentic-security-scanner 0.74.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (331) hide show
  1. package/CHANGELOG.md +1580 -0
  2. package/bin/.agentic-security/findings.json +1577 -0
  3. package/bin/.agentic-security/last-scan.json +1577 -0
  4. package/bin/.agentic-security/last-scan.json.sig +1 -0
  5. package/bin/.agentic-security/scan-history.json +465 -0
  6. package/bin/.agentic-security/streak.json +25 -0
  7. package/bin/agentic-security-audit.js +198 -0
  8. package/bin/agentic-security-consistency.js +80 -0
  9. package/bin/agentic-security-diff.js +136 -0
  10. package/bin/agentic-security-lsp.js +12 -0
  11. package/bin/agentic-security-mcp.js +40 -0
  12. package/bin/agentic-security-rule.js +153 -0
  13. package/bin/agentic-security.js +1683 -0
  14. package/dist/117.index.js +207 -0
  15. package/dist/178.index.js +250 -0
  16. package/dist/218.index.js +793 -0
  17. package/dist/227.index.js +192 -0
  18. package/dist/301.index.js +167 -0
  19. package/dist/384.index.js +18 -0
  20. package/dist/476.index.js +126 -0
  21. package/dist/513.index.js +373 -0
  22. package/dist/520.index.js +13 -0
  23. package/dist/601.index.js +1038 -0
  24. package/dist/634.index.js +1892 -0
  25. package/dist/637.index.js +216 -0
  26. package/dist/660.index.js +131 -0
  27. package/dist/675.index.js +451 -0
  28. package/dist/826.index.js +188 -0
  29. package/dist/830.index.js +133 -0
  30. package/dist/agentic-security.mjs +272 -0
  31. package/dist/agentic-security.mjs.sha256 +1 -0
  32. package/dist/calibration-seed.json +27 -0
  33. package/package.json +77 -0
  34. package/src/.agentic-security/findings.json +80844 -0
  35. package/src/.agentic-security/last-scan.json +80844 -0
  36. package/src/.agentic-security/last-scan.json.sig +1 -0
  37. package/src/.agentic-security/scan-history.json +8408 -0
  38. package/src/.agentic-security/streak.json +26 -0
  39. package/src/badge.js +188 -0
  40. package/src/compare.js +203 -0
  41. package/src/dataflow/.agentic-security/findings.json +3487 -0
  42. package/src/dataflow/.agentic-security/last-scan.json +3487 -0
  43. package/src/dataflow/.agentic-security/last-scan.json.sig +1 -0
  44. package/src/dataflow/.agentic-security/scan-history.json +735 -0
  45. package/src/dataflow/.agentic-security/streak.json +24 -0
  46. package/src/dataflow/CLAUDE.md +38 -0
  47. package/src/dataflow/access-paths.js +172 -0
  48. package/src/dataflow/async-sequencing.js +177 -0
  49. package/src/dataflow/backward.js +201 -0
  50. package/src/dataflow/catalog-expanded.js +485 -0
  51. package/src/dataflow/catalog.js +659 -0
  52. package/src/dataflow/cross-repo.js +219 -0
  53. package/src/dataflow/engine.js +588 -0
  54. package/src/dataflow/exception-flow.js +116 -0
  55. package/src/dataflow/exploit-prover.js +187 -0
  56. package/src/dataflow/higher-order.js +221 -0
  57. package/src/dataflow/ifds.js +347 -0
  58. package/src/dataflow/implicit-flow.js +129 -0
  59. package/src/dataflow/incremental.js +229 -0
  60. package/src/dataflow/index.js +181 -0
  61. package/src/dataflow/numeric-domain.js +192 -0
  62. package/src/dataflow/path-feasibility.js +114 -0
  63. package/src/dataflow/points-to.js +337 -0
  64. package/src/dataflow/polyglot.js +190 -0
  65. package/src/dataflow/proven-clean.js +159 -0
  66. package/src/dataflow/receiver-context.js +76 -0
  67. package/src/dataflow/sanitizer-proof.js +154 -0
  68. package/src/dataflow/soft-taint.js +140 -0
  69. package/src/dataflow/string-domain.js +234 -0
  70. package/src/dataflow/stub-aware-filter.js +100 -0
  71. package/src/dataflow/summaries.js +132 -0
  72. package/src/dataflow/symbolic-exec.js +238 -0
  73. package/src/dataflow/tabulation.js +135 -0
  74. package/src/engine.js +7763 -0
  75. package/src/history-scan.js +229 -0
  76. package/src/index.js +3 -0
  77. package/src/integrations/.agentic-security/findings.json +1504 -0
  78. package/src/integrations/.agentic-security/last-scan.json +1504 -0
  79. package/src/integrations/.agentic-security/scan-history.json +40 -0
  80. package/src/integrations/.agentic-security/streak.json +21 -0
  81. package/src/integrations/index.js +321 -0
  82. package/src/integrations/tickets.js +200 -0
  83. package/src/ir/.agentic-security/findings.json +3036 -0
  84. package/src/ir/.agentic-security/last-scan.json +3036 -0
  85. package/src/ir/.agentic-security/last-scan.json.sig +1 -0
  86. package/src/ir/.agentic-security/scan-history.json +364 -0
  87. package/src/ir/.agentic-security/streak.json +23 -0
  88. package/src/ir/CLAUDE.md +172 -0
  89. package/src/ir/callgraph.js +73 -0
  90. package/src/ir/class-hierarchy.js +195 -0
  91. package/src/ir/index.js +152 -0
  92. package/src/ir/parser-cs.js +260 -0
  93. package/src/ir/parser-java.js +286 -0
  94. package/src/ir/parser-js.js +413 -0
  95. package/src/ir/parser-kt.js +258 -0
  96. package/src/ir/parser-py-cst.js +136 -0
  97. package/src/ir/parser-py.helper.py +501 -0
  98. package/src/ir/parser-py.js +312 -0
  99. package/src/ir/ssa.js +315 -0
  100. package/src/ir/type-stubs.js +288 -0
  101. package/src/leaderboard.js +152 -0
  102. package/src/llm-validator/.agentic-security/findings.json +1891 -0
  103. package/src/llm-validator/.agentic-security/last-scan.json +1891 -0
  104. package/src/llm-validator/.agentic-security/last-scan.json.sig +1 -0
  105. package/src/llm-validator/.agentic-security/scan-history.json +168 -0
  106. package/src/llm-validator/.agentic-security/streak.json +20 -0
  107. package/src/llm-validator/consistency.js +141 -0
  108. package/src/llm-validator/index.js +437 -0
  109. package/src/lsp/.agentic-security/findings.json +28 -0
  110. package/src/lsp/.agentic-security/last-scan.json +28 -0
  111. package/src/lsp/.agentic-security/scan-history.json +79 -0
  112. package/src/lsp/.agentic-security/streak.json +22 -0
  113. package/src/lsp/server.js +275 -0
  114. package/src/mcp/.agentic-security/findings.json +8358 -0
  115. package/src/mcp/.agentic-security/last-scan.json +8358 -0
  116. package/src/mcp/.agentic-security/last-scan.json.sig +1 -0
  117. package/src/mcp/.agentic-security/scan-history.json +1125 -0
  118. package/src/mcp/.agentic-security/streak.json +22 -0
  119. package/src/mcp/CLAUDE.md +54 -0
  120. package/src/mcp/audit.js +136 -0
  121. package/src/mcp/redact.js +75 -0
  122. package/src/mcp/server.js +158 -0
  123. package/src/mcp/stdio.js +83 -0
  124. package/src/mcp/tools.js +940 -0
  125. package/src/mcp/validate.js +49 -0
  126. package/src/personality.js +164 -0
  127. package/src/poc-video.js +239 -0
  128. package/src/posture/.agentic-security/findings.json +51239 -0
  129. package/src/posture/.agentic-security/last-scan.json +51239 -0
  130. package/src/posture/.agentic-security/last-scan.json.sig +1 -0
  131. package/src/posture/.agentic-security/scan-history.json +5557 -0
  132. package/src/posture/.agentic-security/streak.json +24 -0
  133. package/src/posture/CLAUDE.md +42 -0
  134. package/src/posture/adversarial-self-test.js +114 -0
  135. package/src/posture/adversary-agent.js +204 -0
  136. package/src/posture/agents-memory.js +135 -0
  137. package/src/posture/ai-code-fingerprint.js +171 -0
  138. package/src/posture/aibom.js +284 -0
  139. package/src/posture/api-inventory.js +96 -0
  140. package/src/posture/attack-playbooks.js +305 -0
  141. package/src/posture/auditor-agent.js +115 -0
  142. package/src/posture/auth-posture-import.js +135 -0
  143. package/src/posture/baseline-compare.js +114 -0
  144. package/src/posture/blast-radius.js +836 -0
  145. package/src/posture/bounty-prediction.js +141 -0
  146. package/src/posture/business-logic.js +239 -0
  147. package/src/posture/calibration-drift.js +93 -0
  148. package/src/posture/calibration-seed.json +27 -0
  149. package/src/posture/calibration.js +204 -0
  150. package/src/posture/clustering.js +75 -0
  151. package/src/posture/concurrency-checker.js +265 -0
  152. package/src/posture/confidence.js +65 -0
  153. package/src/posture/container-runtime.js +149 -0
  154. package/src/posture/counterfactual.js +109 -0
  155. package/src/posture/cross-lang-graphql.js +165 -0
  156. package/src/posture/cross-lang-grpc.js +166 -0
  157. package/src/posture/cross-lang-meta.js +101 -0
  158. package/src/posture/cross-lang-openapi.js +187 -0
  159. package/src/posture/cross-lang-orm.js +153 -0
  160. package/src/posture/cross-lang-queues.js +210 -0
  161. package/src/posture/crown-jewels.js +110 -0
  162. package/src/posture/custom-rules.js +361 -0
  163. package/src/posture/cve-alert-daemon.js +433 -0
  164. package/src/posture/cve-lookup.js +129 -0
  165. package/src/posture/dead-code.js +430 -0
  166. package/src/posture/defender-agent.js +158 -0
  167. package/src/posture/deploy-platform.js +204 -0
  168. package/src/posture/detector-fuzz.js +61 -0
  169. package/src/posture/deterministic.js +99 -0
  170. package/src/posture/drift.js +165 -0
  171. package/src/posture/epss.js +156 -0
  172. package/src/posture/exploitability-probability.js +212 -0
  173. package/src/posture/exploitability.js +121 -0
  174. package/src/posture/feature-flags.js +110 -0
  175. package/src/posture/finding-defaults.js +132 -0
  176. package/src/posture/fix-history.js +411 -0
  177. package/src/posture/fix-plan.js +121 -0
  178. package/src/posture/fix-verify-loop.js +157 -0
  179. package/src/posture/fix-verify.js +130 -0
  180. package/src/posture/flow-narration.js +105 -0
  181. package/src/posture/grader-calibration.js +156 -0
  182. package/src/posture/harness-discovery.js +113 -0
  183. package/src/posture/holdout-eval.js +144 -0
  184. package/src/posture/iac-reachability.js +163 -0
  185. package/src/posture/iam-policy.js +128 -0
  186. package/src/posture/integrity.js +97 -0
  187. package/src/posture/learning.js +166 -0
  188. package/src/posture/license-policy.js +109 -0
  189. package/src/posture/llm-redteam-prompts.js +418 -0
  190. package/src/posture/llm-redteam.js +303 -0
  191. package/src/posture/material-change.js +163 -0
  192. package/src/posture/mitigation-composite.js +55 -0
  193. package/src/posture/mttr.js +91 -0
  194. package/src/posture/network-policy-import.js +126 -0
  195. package/src/posture/path-predicates.js +99 -0
  196. package/src/posture/persona-prioritization.js +153 -0
  197. package/src/posture/poc-cwe-map.js +51 -0
  198. package/src/posture/poc-generator.js +500 -0
  199. package/src/posture/policy-gate.js +174 -0
  200. package/src/posture/pre-incident-archaeology.js +110 -0
  201. package/src/posture/profile.js +93 -0
  202. package/src/posture/reachability-filter.js +42 -0
  203. package/src/posture/regression-test-gen.js +200 -0
  204. package/src/posture/reverse-blast-radius.js +110 -0
  205. package/src/posture/router.js +109 -0
  206. package/src/posture/rule-overrides.js +198 -0
  207. package/src/posture/rule-pack-signing.js +209 -0
  208. package/src/posture/rule-packs.js +143 -0
  209. package/src/posture/rule-synthesis.js +108 -0
  210. package/src/posture/ruleset-version.js +71 -0
  211. package/src/posture/sbom.js +129 -0
  212. package/src/posture/schema-aware-bridge.js +207 -0
  213. package/src/posture/security-trend.js +87 -0
  214. package/src/posture/semantic-clone.js +114 -0
  215. package/src/posture/specification-mining.js +170 -0
  216. package/src/posture/stable-id.js +75 -0
  217. package/src/posture/stack-playbook.js +229 -0
  218. package/src/posture/streak.js +249 -0
  219. package/src/posture/suppressions.js +135 -0
  220. package/src/posture/telemetry-ingest.js +112 -0
  221. package/src/posture/threat-model.js +145 -0
  222. package/src/posture/three-agent-pipeline.js +74 -0
  223. package/src/posture/triage.js +146 -0
  224. package/src/posture/trust-boundary-diagram.js +115 -0
  225. package/src/posture/type-narrowing.js +129 -0
  226. package/src/posture/validator-metrics.js +179 -0
  227. package/src/posture/verifier-ephemeral.js +118 -0
  228. package/src/posture/verifier-target.js +147 -0
  229. package/src/posture/verifier.js +257 -0
  230. package/src/posture/version.js +75 -0
  231. package/src/posture/waf-ingest.js +200 -0
  232. package/src/posture/why-fired.js +141 -0
  233. package/src/pr-comment.js +172 -0
  234. package/src/pr-delta.js +198 -0
  235. package/src/report/.agentic-security/findings.json +79 -0
  236. package/src/report/.agentic-security/last-scan.json +79 -0
  237. package/src/report/.agentic-security/last-scan.json.sig +1 -0
  238. package/src/report/.agentic-security/scan-history.json +332 -0
  239. package/src/report/.agentic-security/streak.json +23 -0
  240. package/src/report/index.js +1136 -0
  241. package/src/report/mascot.js +42 -0
  242. package/src/runScan.js +141 -0
  243. package/src/sast/.agentic-security/findings.json +5051 -0
  244. package/src/sast/.agentic-security/last-scan.json +5051 -0
  245. package/src/sast/.agentic-security/last-scan.json.sig +1 -0
  246. package/src/sast/.agentic-security/scan-history.json +788 -0
  247. package/src/sast/.agentic-security/streak.json +23 -0
  248. package/src/sast/CLAUDE.md +39 -0
  249. package/src/sast/_comment-strip.js +46 -0
  250. package/src/sast/agent-tool-escalation.js +131 -0
  251. package/src/sast/auth-provider.js +171 -0
  252. package/src/sast/authz.js +236 -0
  253. package/src/sast/bench-shape/.agentic-security/findings.json +28 -0
  254. package/src/sast/bench-shape/.agentic-security/last-scan.json +28 -0
  255. package/src/sast/bench-shape/.agentic-security/scan-history.json +24 -0
  256. package/src/sast/bench-shape/.agentic-security/streak.json +22 -0
  257. package/src/sast/bench-shape/index.js +62 -0
  258. package/src/sast/claude-hook-injection.js +199 -0
  259. package/src/sast/claude-md-prompt-injection.js +170 -0
  260. package/src/sast/claude-settings.js +165 -0
  261. package/src/sast/client-side.js +149 -0
  262. package/src/sast/cpp-bench-extras.js +122 -0
  263. package/src/sast/cpp-dataflow.js +430 -0
  264. package/src/sast/cpp.js +248 -0
  265. package/src/sast/csharp.js +152 -0
  266. package/src/sast/csrf.js +82 -0
  267. package/src/sast/dart-flutter.js +173 -0
  268. package/src/sast/db-rls.js +147 -0
  269. package/src/sast/db-taint.js +215 -0
  270. package/src/sast/defi-deep.js +242 -0
  271. package/src/sast/deserialization-gadgets.js +113 -0
  272. package/src/sast/django-hardening.js +230 -0
  273. package/src/sast/env-hygiene.js +125 -0
  274. package/src/sast/fastapi-hardening.js +145 -0
  275. package/src/sast/go-extended.js +84 -0
  276. package/src/sast/host-header.js +106 -0
  277. package/src/sast/index.js +17 -0
  278. package/src/sast/java-ast-folding.js +561 -0
  279. package/src/sast/java-bench-extras.js +708 -0
  280. package/src/sast/java-collection-passthrough.js +178 -0
  281. package/src/sast/java-constant-fold.js +244 -0
  282. package/src/sast/java-deserialization.js +125 -0
  283. package/src/sast/jndi.js +104 -0
  284. package/src/sast/juliet-shape.js +324 -0
  285. package/src/sast/jwt-exp.js +104 -0
  286. package/src/sast/kotlin.js +82 -0
  287. package/src/sast/laravel-hardening.js +198 -0
  288. package/src/sast/ldap-injection.js +100 -0
  289. package/src/sast/llm-owasp.js +465 -0
  290. package/src/sast/llm-stored-prompt.js +103 -0
  291. package/src/sast/llm-trading-agent.js +161 -0
  292. package/src/sast/llm.js +308 -0
  293. package/src/sast/logic.js +140 -0
  294. package/src/sast/mass-assignment.js +101 -0
  295. package/src/sast/mcp-audit.js +242 -0
  296. package/src/sast/mobile-manifest.js +195 -0
  297. package/src/sast/model-load.js +164 -0
  298. package/src/sast/mutation-xss.js +87 -0
  299. package/src/sast/nosql-injection.js +82 -0
  300. package/src/sast/open-redirect.js +119 -0
  301. package/src/sast/php.js +91 -0
  302. package/src/sast/pipeline.js +122 -0
  303. package/src/sast/primary-cwe-java.js +155 -0
  304. package/src/sast/prompt-firewall.js +151 -0
  305. package/src/sast/prompt-template.js +157 -0
  306. package/src/sast/prototype-pollution.js +112 -0
  307. package/src/sast/python-sinks.js +195 -0
  308. package/src/sast/quarkus-hardening.js +102 -0
  309. package/src/sast/rag-poisoning.js +118 -0
  310. package/src/sast/rate-limit.js +128 -0
  311. package/src/sast/response-splitting.js +138 -0
  312. package/src/sast/ruby.js +108 -0
  313. package/src/sast/rust.js +105 -0
  314. package/src/sast/solidity.js +167 -0
  315. package/src/sast/springboot-hardening.js +186 -0
  316. package/src/sast/ssrf-cloud-metadata.js +80 -0
  317. package/src/sast/ssti.js +116 -0
  318. package/src/sast/swift.js +162 -0
  319. package/src/sast/toctou.js +95 -0
  320. package/src/sast/webhook.js +101 -0
  321. package/src/sast/xpath-injection.js +51 -0
  322. package/src/sast/xxe.js +140 -0
  323. package/src/sast/zip-slip.js +200 -0
  324. package/src/sca/base-images.json +45 -0
  325. package/src/sca/container.js +107 -0
  326. package/src/sca/dep-confusion.js +134 -0
  327. package/src/sca/index.js +6 -0
  328. package/src/sca/popular-packages.json +41 -0
  329. package/src/sca/sarif-ingest.js +187 -0
  330. package/src/sca/vuln-function-hints.json +89 -0
  331. package/src/secrets/index.js +4 -0
package/src/sast/.agentic-security/scan-history.json ADDED
@@ -0,0 +1,788 @@
1
+ [
2
+ {
3
+ "timestamp": "2026-05-19T14:14:43.272Z",
4
+ "label": "scan",
5
+ "total": 10,
6
+ "critical": 0,
7
+ "high": 9,
8
+ "medium": 1,
9
+ "low": 0,
10
+ "kev": 0,
11
+ "ids": [
12
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
13
+ "client-side:CLIENT_EVAL:client-side.js:135",
14
+ "client-side:CLIENT_EVAL:client-side.js:139",
15
+ "client-side:CLIENT_EVAL:client-side.js:140",
16
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
17
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
18
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
19
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
20
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
21
+ "zip-slip:zip-slip.js:192:node-entry"
22
+ ]
23
+ },
24
+ {
25
+ "timestamp": "2026-05-19T14:15:45.304Z",
26
+ "label": "scan",
27
+ "total": 10,
28
+ "critical": 0,
29
+ "high": 9,
30
+ "medium": 1,
31
+ "low": 0,
32
+ "kev": 0,
33
+ "ids": [
34
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
35
+ "client-side:CLIENT_EVAL:client-side.js:135",
36
+ "client-side:CLIENT_EVAL:client-side.js:139",
37
+ "client-side:CLIENT_EVAL:client-side.js:140",
38
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
39
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
40
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
41
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
42
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
43
+ "zip-slip:zip-slip.js:192:node-entry"
44
+ ]
45
+ },
46
+ {
47
+ "timestamp": "2026-05-19T14:16:41.598Z",
48
+ "label": "scan",
49
+ "total": 10,
50
+ "critical": 0,
51
+ "high": 9,
52
+ "medium": 1,
53
+ "low": 0,
54
+ "kev": 0,
55
+ "ids": [
56
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
57
+ "client-side:CLIENT_EVAL:client-side.js:135",
58
+ "client-side:CLIENT_EVAL:client-side.js:139",
59
+ "client-side:CLIENT_EVAL:client-side.js:140",
60
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
61
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
62
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
63
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
64
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
65
+ "zip-slip:zip-slip.js:192:node-entry"
66
+ ]
67
+ },
68
+ {
69
+ "timestamp": "2026-05-19T14:17:46.030Z",
70
+ "label": "scan",
71
+ "total": 10,
72
+ "critical": 0,
73
+ "high": 9,
74
+ "medium": 1,
75
+ "low": 0,
76
+ "kev": 0,
77
+ "ids": [
78
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
79
+ "client-side:CLIENT_EVAL:client-side.js:135",
80
+ "client-side:CLIENT_EVAL:client-side.js:139",
81
+ "client-side:CLIENT_EVAL:client-side.js:140",
82
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
83
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
84
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
85
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
86
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
87
+ "zip-slip:zip-slip.js:192:node-entry"
88
+ ]
89
+ },
90
+ {
91
+ "timestamp": "2026-05-19T14:18:37.970Z",
92
+ "label": "scan",
93
+ "total": 10,
94
+ "critical": 0,
95
+ "high": 9,
96
+ "medium": 1,
97
+ "low": 0,
98
+ "kev": 0,
99
+ "ids": [
100
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
101
+ "client-side:CLIENT_EVAL:client-side.js:135",
102
+ "client-side:CLIENT_EVAL:client-side.js:139",
103
+ "client-side:CLIENT_EVAL:client-side.js:140",
104
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
105
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
106
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
107
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
108
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
109
+ "zip-slip:zip-slip.js:192:node-entry"
110
+ ]
111
+ },
112
+ {
113
+ "timestamp": "2026-05-19T14:19:36.932Z",
114
+ "label": "scan",
115
+ "total": 10,
116
+ "critical": 0,
117
+ "high": 9,
118
+ "medium": 1,
119
+ "low": 0,
120
+ "kev": 0,
121
+ "ids": [
122
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
123
+ "client-side:CLIENT_EVAL:client-side.js:135",
124
+ "client-side:CLIENT_EVAL:client-side.js:139",
125
+ "client-side:CLIENT_EVAL:client-side.js:140",
126
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
127
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
128
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
129
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
130
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
131
+ "zip-slip:zip-slip.js:192:node-entry"
132
+ ]
133
+ },
134
+ {
135
+ "timestamp": "2026-05-19T14:20:31.950Z",
136
+ "label": "scan",
137
+ "total": 10,
138
+ "critical": 0,
139
+ "high": 9,
140
+ "medium": 1,
141
+ "low": 0,
142
+ "kev": 0,
143
+ "ids": [
144
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
145
+ "client-side:CLIENT_EVAL:client-side.js:135",
146
+ "client-side:CLIENT_EVAL:client-side.js:139",
147
+ "client-side:CLIENT_EVAL:client-side.js:140",
148
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
149
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
150
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
151
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
152
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
153
+ "zip-slip:zip-slip.js:192:node-entry"
154
+ ]
155
+ },
156
+ {
157
+ "timestamp": "2026-05-19T14:21:03.047Z",
158
+ "label": "scan",
159
+ "total": 10,
160
+ "critical": 0,
161
+ "high": 9,
162
+ "medium": 1,
163
+ "low": 0,
164
+ "kev": 0,
165
+ "ids": [
166
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
167
+ "client-side:CLIENT_EVAL:client-side.js:135",
168
+ "client-side:CLIENT_EVAL:client-side.js:139",
169
+ "client-side:CLIENT_EVAL:client-side.js:140",
170
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
171
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
172
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
173
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
174
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
175
+ "zip-slip:zip-slip.js:192:node-entry"
176
+ ]
177
+ },
178
+ {
179
+ "timestamp": "2026-05-19T14:21:45.837Z",
180
+ "label": "scan",
181
+ "total": 10,
182
+ "critical": 0,
183
+ "high": 9,
184
+ "medium": 1,
185
+ "low": 0,
186
+ "kev": 0,
187
+ "ids": [
188
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
189
+ "client-side:CLIENT_EVAL:client-side.js:135",
190
+ "client-side:CLIENT_EVAL:client-side.js:139",
191
+ "client-side:CLIENT_EVAL:client-side.js:140",
192
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
193
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
194
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
195
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
196
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
197
+ "zip-slip:zip-slip.js:192:node-entry"
198
+ ]
199
+ },
200
+ {
201
+ "timestamp": "2026-05-19T14:24:44.477Z",
202
+ "label": "scan",
203
+ "total": 10,
204
+ "critical": 0,
205
+ "high": 9,
206
+ "medium": 1,
207
+ "low": 0,
208
+ "kev": 0,
209
+ "ids": [
210
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
211
+ "client-side:CLIENT_EVAL:client-side.js:135",
212
+ "client-side:CLIENT_EVAL:client-side.js:139",
213
+ "client-side:CLIENT_EVAL:client-side.js:140",
214
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
215
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
216
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
217
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
218
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
219
+ "zip-slip:zip-slip.js:192:node-entry"
220
+ ]
221
+ },
222
+ {
223
+ "timestamp": "2026-05-19T14:24:50.750Z",
224
+ "label": "scan",
225
+ "total": 10,
226
+ "critical": 0,
227
+ "high": 9,
228
+ "medium": 1,
229
+ "low": 0,
230
+ "kev": 0,
231
+ "ids": [
232
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
233
+ "client-side:CLIENT_EVAL:client-side.js:135",
234
+ "client-side:CLIENT_EVAL:client-side.js:139",
235
+ "client-side:CLIENT_EVAL:client-side.js:140",
236
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
237
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
238
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
239
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
240
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
241
+ "zip-slip:zip-slip.js:192:node-entry"
242
+ ]
243
+ },
244
+ {
245
+ "timestamp": "2026-05-19T14:53:08.606Z",
246
+ "label": "scan",
247
+ "total": 10,
248
+ "critical": 0,
249
+ "high": 9,
250
+ "medium": 1,
251
+ "low": 0,
252
+ "kev": 0,
253
+ "ids": [
254
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
255
+ "client-side:CLIENT_EVAL:client-side.js:135",
256
+ "client-side:CLIENT_EVAL:client-side.js:139",
257
+ "client-side:CLIENT_EVAL:client-side.js:140",
258
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
259
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
260
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
261
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
262
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
263
+ "zip-slip:zip-slip.js:192:node-entry"
264
+ ]
265
+ },
266
+ {
267
+ "timestamp": "2026-05-19T21:18:42.442Z",
268
+ "label": "scan",
269
+ "total": 17,
270
+ "critical": 0,
271
+ "high": 0,
272
+ "medium": 2,
273
+ "low": 15,
274
+ "kev": 0,
275
+ "ids": [
276
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
277
+ "client-side:CLIENT_EVAL:client-side.js:135",
278
+ "client-side:CLIENT_EVAL:client-side.js:139",
279
+ "client-side:CLIENT_EVAL:client-side.js:140",
280
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
281
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
282
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
283
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
284
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
285
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
286
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
287
+ "ssrf-meta-hardcoded:go-extended.js:39",
288
+ "ssrf-meta-hardcoded:python-sinks.js:186",
289
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
290
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
291
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
292
+ "zip-slip:zip-slip.js:192:node-entry"
293
+ ]
294
+ },
295
+ {
296
+ "timestamp": "2026-05-20T12:47:36.689Z",
297
+ "label": "scan",
298
+ "total": 17,
299
+ "critical": 0,
300
+ "high": 0,
301
+ "medium": 2,
302
+ "low": 15,
303
+ "kev": 0,
304
+ "ids": [
305
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
306
+ "client-side:CLIENT_EVAL:client-side.js:135",
307
+ "client-side:CLIENT_EVAL:client-side.js:139",
308
+ "client-side:CLIENT_EVAL:client-side.js:140",
309
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
310
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
311
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
312
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
313
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
314
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
315
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
316
+ "ssrf-meta-hardcoded:go-extended.js:39",
317
+ "ssrf-meta-hardcoded:python-sinks.js:186",
318
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
319
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
320
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
321
+ "zip-slip:zip-slip.js:192:node-entry"
322
+ ]
323
+ },
324
+ {
325
+ "timestamp": "2026-05-20T12:48:13.459Z",
326
+ "label": "scan",
327
+ "total": 17,
328
+ "critical": 0,
329
+ "high": 0,
330
+ "medium": 2,
331
+ "low": 15,
332
+ "kev": 0,
333
+ "ids": [
334
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
335
+ "client-side:CLIENT_EVAL:client-side.js:135",
336
+ "client-side:CLIENT_EVAL:client-side.js:139",
337
+ "client-side:CLIENT_EVAL:client-side.js:140",
338
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
339
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
340
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
341
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
342
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
343
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
344
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
345
+ "ssrf-meta-hardcoded:go-extended.js:39",
346
+ "ssrf-meta-hardcoded:python-sinks.js:186",
347
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
348
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
349
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
350
+ "zip-slip:zip-slip.js:192:node-entry"
351
+ ]
352
+ },
353
+ {
354
+ "timestamp": "2026-05-20T12:49:02.792Z",
355
+ "label": "scan",
356
+ "total": 17,
357
+ "critical": 0,
358
+ "high": 0,
359
+ "medium": 2,
360
+ "low": 15,
361
+ "kev": 0,
362
+ "ids": [
363
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
364
+ "client-side:CLIENT_EVAL:client-side.js:135",
365
+ "client-side:CLIENT_EVAL:client-side.js:139",
366
+ "client-side:CLIENT_EVAL:client-side.js:140",
367
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
368
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
369
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
370
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
371
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
372
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
373
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
374
+ "ssrf-meta-hardcoded:go-extended.js:39",
375
+ "ssrf-meta-hardcoded:python-sinks.js:186",
376
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
377
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
378
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
379
+ "zip-slip:zip-slip.js:192:node-entry"
380
+ ]
381
+ },
382
+ {
383
+ "timestamp": "2026-05-20T12:49:42.738Z",
384
+ "label": "scan",
385
+ "total": 17,
386
+ "critical": 0,
387
+ "high": 0,
388
+ "medium": 2,
389
+ "low": 15,
390
+ "kev": 0,
391
+ "ids": [
392
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
393
+ "client-side:CLIENT_EVAL:client-side.js:135",
394
+ "client-side:CLIENT_EVAL:client-side.js:139",
395
+ "client-side:CLIENT_EVAL:client-side.js:140",
396
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
397
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
398
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
399
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
400
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
401
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
402
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
403
+ "ssrf-meta-hardcoded:go-extended.js:39",
404
+ "ssrf-meta-hardcoded:python-sinks.js:186",
405
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
406
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
407
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
408
+ "zip-slip:zip-slip.js:192:node-entry"
409
+ ]
410
+ },
411
+ {
412
+ "timestamp": "2026-05-20T12:51:21.872Z",
413
+ "label": "scan",
414
+ "total": 17,
415
+ "critical": 0,
416
+ "high": 0,
417
+ "medium": 2,
418
+ "low": 15,
419
+ "kev": 0,
420
+ "ids": [
421
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
422
+ "client-side:CLIENT_EVAL:client-side.js:135",
423
+ "client-side:CLIENT_EVAL:client-side.js:139",
424
+ "client-side:CLIENT_EVAL:client-side.js:140",
425
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
426
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
427
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
428
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
429
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
430
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
431
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
432
+ "ssrf-meta-hardcoded:go-extended.js:39",
433
+ "ssrf-meta-hardcoded:python-sinks.js:186",
434
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
435
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
436
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
437
+ "zip-slip:zip-slip.js:192:node-entry"
438
+ ]
439
+ },
440
+ {
441
+ "timestamp": "2026-05-20T12:51:36.006Z",
442
+ "label": "scan",
443
+ "total": 17,
444
+ "critical": 0,
445
+ "high": 0,
446
+ "medium": 2,
447
+ "low": 15,
448
+ "kev": 0,
449
+ "ids": [
450
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
451
+ "client-side:CLIENT_EVAL:client-side.js:135",
452
+ "client-side:CLIENT_EVAL:client-side.js:139",
453
+ "client-side:CLIENT_EVAL:client-side.js:140",
454
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
455
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
456
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
457
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
458
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
459
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
460
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
461
+ "ssrf-meta-hardcoded:go-extended.js:39",
462
+ "ssrf-meta-hardcoded:python-sinks.js:186",
463
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
464
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
465
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
466
+ "zip-slip:zip-slip.js:192:node-entry"
467
+ ]
468
+ },
469
+ {
470
+ "timestamp": "2026-05-20T12:52:34.978Z",
471
+ "label": "scan",
472
+ "total": 17,
473
+ "critical": 0,
474
+ "high": 0,
475
+ "medium": 2,
476
+ "low": 15,
477
+ "kev": 0,
478
+ "ids": [
479
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
480
+ "client-side:CLIENT_EVAL:client-side.js:135",
481
+ "client-side:CLIENT_EVAL:client-side.js:139",
482
+ "client-side:CLIENT_EVAL:client-side.js:140",
483
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
484
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
485
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
486
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
487
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
488
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
489
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
490
+ "ssrf-meta-hardcoded:go-extended.js:39",
491
+ "ssrf-meta-hardcoded:python-sinks.js:186",
492
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
493
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
494
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
495
+ "zip-slip:zip-slip.js:192:node-entry"
496
+ ]
497
+ },
498
+ {
499
+ "timestamp": "2026-05-20T12:52:49.358Z",
500
+ "label": "scan",
501
+ "total": 17,
502
+ "critical": 0,
503
+ "high": 0,
504
+ "medium": 2,
505
+ "low": 15,
506
+ "kev": 0,
507
+ "ids": [
508
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
509
+ "client-side:CLIENT_EVAL:client-side.js:135",
510
+ "client-side:CLIENT_EVAL:client-side.js:139",
511
+ "client-side:CLIENT_EVAL:client-side.js:140",
512
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
513
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
514
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
515
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
516
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
517
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
518
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
519
+ "ssrf-meta-hardcoded:go-extended.js:39",
520
+ "ssrf-meta-hardcoded:python-sinks.js:186",
521
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
522
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
523
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
524
+ "zip-slip:zip-slip.js:192:node-entry"
525
+ ]
526
+ },
527
+ {
528
+ "timestamp": "2026-05-20T12:54:08.915Z",
529
+ "label": "scan",
530
+ "total": 17,
531
+ "critical": 0,
532
+ "high": 0,
533
+ "medium": 2,
534
+ "low": 15,
535
+ "kev": 0,
536
+ "ids": [
537
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
538
+ "client-side:CLIENT_EVAL:client-side.js:135",
539
+ "client-side:CLIENT_EVAL:client-side.js:139",
540
+ "client-side:CLIENT_EVAL:client-side.js:140",
541
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
542
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
543
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
544
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
545
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
546
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
547
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
548
+ "ssrf-meta-hardcoded:go-extended.js:39",
549
+ "ssrf-meta-hardcoded:python-sinks.js:186",
550
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
551
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
552
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
553
+ "zip-slip:zip-slip.js:192:node-entry"
554
+ ]
555
+ },
556
+ {
557
+ "timestamp": "2026-05-20T15:30:14.990Z",
558
+ "label": "scan",
559
+ "total": 17,
560
+ "critical": 0,
561
+ "high": 0,
562
+ "medium": 2,
563
+ "low": 15,
564
+ "kev": 0,
565
+ "ids": [
566
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
567
+ "client-side:CLIENT_EVAL:client-side.js:135",
568
+ "client-side:CLIENT_EVAL:client-side.js:139",
569
+ "client-side:CLIENT_EVAL:client-side.js:140",
570
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
571
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
572
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
573
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
574
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
575
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
576
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
577
+ "ssrf-meta-hardcoded:go-extended.js:39",
578
+ "ssrf-meta-hardcoded:python-sinks.js:186",
579
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
580
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
581
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
582
+ "zip-slip:zip-slip.js:192:node-entry"
583
+ ]
584
+ },
585
+ {
586
+ "timestamp": "2026-05-20T15:30:55.692Z",
587
+ "label": "scan",
588
+ "total": 17,
589
+ "critical": 0,
590
+ "high": 0,
591
+ "medium": 2,
592
+ "low": 15,
593
+ "kev": 0,
594
+ "ids": [
595
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
596
+ "client-side:CLIENT_EVAL:client-side.js:135",
597
+ "client-side:CLIENT_EVAL:client-side.js:139",
598
+ "client-side:CLIENT_EVAL:client-side.js:140",
599
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
600
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
601
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
602
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
603
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
604
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
605
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
606
+ "ssrf-meta-hardcoded:go-extended.js:39",
607
+ "ssrf-meta-hardcoded:python-sinks.js:186",
608
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
609
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
610
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
611
+ "zip-slip:zip-slip.js:192:node-entry"
612
+ ]
613
+ },
614
+ {
615
+ "timestamp": "2026-05-20T15:31:40.849Z",
616
+ "label": "scan",
617
+ "total": 17,
618
+ "critical": 0,
619
+ "high": 0,
620
+ "medium": 2,
621
+ "low": 15,
622
+ "kev": 0,
623
+ "ids": [
624
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
625
+ "client-side:CLIENT_EVAL:client-side.js:135",
626
+ "client-side:CLIENT_EVAL:client-side.js:139",
627
+ "client-side:CLIENT_EVAL:client-side.js:140",
628
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
629
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
630
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
631
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
632
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
633
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
634
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
635
+ "ssrf-meta-hardcoded:go-extended.js:39",
636
+ "ssrf-meta-hardcoded:python-sinks.js:186",
637
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
638
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
639
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
640
+ "zip-slip:zip-slip.js:192:node-entry"
641
+ ]
642
+ },
643
+ {
644
+ "timestamp": "2026-05-20T15:33:07.999Z",
645
+ "label": "scan",
646
+ "total": 17,
647
+ "critical": 0,
648
+ "high": 0,
649
+ "medium": 2,
650
+ "low": 15,
651
+ "kev": 0,
652
+ "ids": [
653
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
654
+ "client-side:CLIENT_EVAL:client-side.js:135",
655
+ "client-side:CLIENT_EVAL:client-side.js:139",
656
+ "client-side:CLIENT_EVAL:client-side.js:140",
657
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
658
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
659
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
660
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
661
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
662
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
663
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
664
+ "ssrf-meta-hardcoded:go-extended.js:39",
665
+ "ssrf-meta-hardcoded:python-sinks.js:186",
666
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
667
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
668
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
669
+ "zip-slip:zip-slip.js:192:node-entry"
670
+ ]
671
+ },
672
+ {
673
+ "timestamp": "2026-05-20T17:05:28.913Z",
674
+ "label": "scan",
675
+ "total": 17,
676
+ "critical": 0,
677
+ "high": 0,
678
+ "medium": 2,
679
+ "low": 15,
680
+ "kev": 0,
681
+ "ids": [
682
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
683
+ "client-side:CLIENT_EVAL:client-side.js:135",
684
+ "client-side:CLIENT_EVAL:client-side.js:139",
685
+ "client-side:CLIENT_EVAL:client-side.js:140",
686
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
687
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
688
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
689
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
690
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
691
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
692
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
693
+ "ssrf-meta-hardcoded:go-extended.js:39",
694
+ "ssrf-meta-hardcoded:python-sinks.js:186",
695
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
696
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
697
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
698
+ "zip-slip:zip-slip.js:192:node-entry"
699
+ ]
700
+ },
701
+ {
702
+ "timestamp": "2026-05-20T17:06:53.366Z",
703
+ "label": "scan",
704
+ "total": 17,
705
+ "critical": 0,
706
+ "high": 0,
707
+ "medium": 2,
708
+ "low": 15,
709
+ "kev": 0,
710
+ "ids": [
711
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
712
+ "client-side:CLIENT_EVAL:client-side.js:135",
713
+ "client-side:CLIENT_EVAL:client-side.js:139",
714
+ "client-side:CLIENT_EVAL:client-side.js:140",
715
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
716
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
717
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
718
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
719
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
720
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
721
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
722
+ "ssrf-meta-hardcoded:go-extended.js:39",
723
+ "ssrf-meta-hardcoded:python-sinks.js:186",
724
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
725
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
726
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
727
+ "zip-slip:zip-slip.js:192:node-entry"
728
+ ]
729
+ },
730
+ {
731
+ "timestamp": "2026-05-20T17:07:18.341Z",
732
+ "label": "scan",
733
+ "total": 17,
734
+ "critical": 0,
735
+ "high": 0,
736
+ "medium": 2,
737
+ "low": 15,
738
+ "kev": 0,
739
+ "ids": [
740
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
741
+ "client-side:CLIENT_EVAL:client-side.js:135",
742
+ "client-side:CLIENT_EVAL:client-side.js:139",
743
+ "client-side:CLIENT_EVAL:client-side.js:140",
744
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
745
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
746
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
747
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
748
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
749
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
750
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
751
+ "ssrf-meta-hardcoded:go-extended.js:39",
752
+ "ssrf-meta-hardcoded:python-sinks.js:186",
753
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
754
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
755
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
756
+ "zip-slip:zip-slip.js:192:node-entry"
757
+ ]
758
+ },
759
+ {
760
+ "timestamp": "2026-05-20T17:07:59.605Z",
761
+ "label": "scan",
762
+ "total": 17,
763
+ "critical": 0,
764
+ "high": 0,
765
+ "medium": 2,
766
+ "low": 15,
767
+ "kev": 0,
768
+ "ids": [
769
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
770
+ "client-side:CLIENT_EVAL:client-side.js:135",
771
+ "client-side:CLIENT_EVAL:client-side.js:139",
772
+ "client-side:CLIENT_EVAL:client-side.js:140",
773
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
774
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
775
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
776
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
777
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
778
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
779
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
780
+ "ssrf-meta-hardcoded:go-extended.js:39",
781
+ "ssrf-meta-hardcoded:python-sinks.js:186",
782
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
783
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
784
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
785
+ "zip-slip:zip-slip.js:192:node-entry"
786
+ ]
787
+ }
788
+ ]