@clear-capabilities/agentic-security-scanner 0.76.1 → 0.77.0

package/src/dataflow/.agentic-security/last-scan.json

@@ -1,3487 +0,0 @@
-{
-  "scanId": "c0ec088f-7109-4755-b599-aa770643cf19",
-  "startedAt": "2026-05-20T21:19:04.813Z",
-  "durationMs": 486,
-  "scanned": {
-    "files": 27,
-    "lines": 0
-  },
-  "findings": [
-    {
-      "id": "struct:incremental.js:50:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "kind": "sast",
-      "severity": "medium",
-      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
-      "cwe": "CWE-400",
-      "owaspLlm": null,
-      "stride": "Denial of Service",
-      "file": "incremental.js",
-      "line": 50,
-      "snippet": "if (!fs.existsSync(versionFp)) return _emptyState();",
-      "fix": null,
-      "reachable": false,
-      "triage": 22,
-      "dataClasses": [],
-      "chain": null,
-      "confidence": 0.212,
-      "toxicity": 28,
-      "toxicityFactors": [
-        "http-facing"
-      ],
-      "toxicityLabel": "Medium",
-      "sources": null,
-      "epssScore": null,
-      "epssPercentile": null,
-      "epssCve": null,
-      "exploitedNow": false,
-      "tags": null,
-      "blastRadius": {
-        "scope": "all-users",
-        "dataAtRisk": [
-          "config"
-        ],
-        "userCount": 50,
-        "industry": "generic",
-        "jurisdictions": [],
-        "controlsApplied": [],
-        "dollarBest": 23250,
-        "dollarLikely": 136250,
-        "dollarWorst": 775000,
-        "dollarLow": 23250,
-        "dollarHigh": 775000,
-        "components": {
-          "incidentResponse": {
-            "low": 8000,
-            "likely": 50000,
-            "high": 250000
-          },
-          "legal": {
-            "low": 10000,
-            "likely": 75000,
-            "high": 500000
-          },
-          "crisisPR": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "notification": {
-            "low": 5000,
-            "likely": 10000,
-            "high": 15000
-          },
-          "creditMonitoring": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "regulatoryFines": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "directDamage": {
-            "low": 250,
-            "likely": 1250,
-            "high": 10000
-          },
-          "classAction": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "lostBusiness": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          }
-        },
-        "dominantDriver": "legal counsel",
-        "comparable": "Air Canada 2024 LLM chatbot DoS → court-ordered refunds + reputational damage",
-        "confidence": "low",
-        "narrative": "Synchronous Blocking I/O (DoS Risk in Server Context) on `incremental.js:50` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Air Canada 2024 LLM chatbot DoS → court-ordered refunds + reputational damage."
-      },
-      "stableId": "7e2db52a92ce3811",
-      "confidenceTier": "very-low",
-      "exploitability": 0.2,
-      "exploitabilityTier": "low",
-      "exploitabilityFactors": [
-        "sev:medium",
-        "unreachable"
-      ],
-      "clusterSize": null,
-      "unreachable": false,
-      "validator_verdict": "unvalidated",
-      "llm_confidence": null,
-      "unvalidated": true,
-      "cross_language": false,
-      "family": "dos-sync-io",
-      "_unsigned": false,
-      "_passThroughSigning": false,
-      "signatureStatus": "verified",
-      "regression_test": null,
-      "poc": null,
-      "calibrated_confidence": null,
-      "calibrated_confidence_ci": null,
-      "calibrated_n": 0,
-      "calibration_reason": "no-history",
-      "verifier_verdict": "cannot-verify",
-      "verifier_reason": "no-poc-no-sanitizer-rule",
-      "verifier_runner": null,
-      "narration": null,
-      "mitigationVerdict": "unreachable-in-prod",
-      "mitigationsApplied": [],
-      "mitigatedByWaf": false,
-      "wafRuleId": null,
-      "mitigatedByAuth": false,
-      "authMechanism": null,
-      "mitigatedByNetwork": false,
-      "networkExposure": null,
-      "featureFlag": null,
-      "featureFlagState": null,
-      "featureFlagRollout": null,
-      "exposedInProd": false,
-      "unreachableInProd": true,
-      "coldPath": false,
-      "hotPath": false,
-      "prodRequestCount": null,
-      "crownJewelScore": 0,
-      "crownJewelTier": "unknown",
-      "crownJewelFactors": [],
-      "cloneClusterId": "bf9643a065f64945",
-      "cloneClusterSize": 2,
-      "provenance": "human-likely",
-      "provenanceScore": 0.22,
-      "typeNarrowed": null,
-      "strideCategory": "denialOfService",
-      "personaScores": {
-        "script-kiddie": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "opportunistic-criminal": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "apt-nation-state": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "supply-chain-attacker": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "malicious-insider": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        }
-      },
-      "personaTopTwo": [
-        "script-kiddie",
-        "opportunistic-criminal"
-      ],
-      "personaMaxName": "script-kiddie",
-      "personaMaxScore": 0.4,
-      "reverseExposure": null,
-      "specMined": null,
-      "whyFired": {
-        "detector": "sast/dos-sync-io",
-        "ruleId": "CWE-400",
-        "parser": "STRUCTURAL",
-        "evidence": {
-          "sinkSnippet": "if (!fs.existsSync(versionFp)) return _emptyState();",
-          "sourceSnippet": "if (!fs.existsSync(versionFp)) return _emptyState();",
-          "pathSteps": [],
-          "sanitizers": [],
-          "guards": []
-        },
-        "considered": {
-          "suppressionsApplied": [],
-          "suppressionsSkipped": [],
-          "reachabilityFilter": "unaffected",
-          "clusterCollapsed": false,
-          "typeNarrowed": false,
-          "crownJewelTier": "unknown",
-          "mitigationVerdict": "unreachable-in-prod"
-        },
-        "scanner": {
-          "rulesetVersion": null,
-          "packHash": null,
-          "modelId": null
-        }
-      },
-      "adversaryTranscript": null,
-      "predictedBountyUsd": {
-        "low": 10,
-        "likely": 40,
-        "high": 120,
-        "program": "web2"
-      },
-      "bountyConfidence": "high",
-      "attackPlaybook": null
-    },
-    {
-      "id": "struct:incremental.js:51:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "kind": "sast",
-      "severity": "medium",
-      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
-      "cwe": "CWE-400",
-      "owaspLlm": null,
-      "stride": "Denial of Service",
-      "file": "incremental.js",
-      "line": 51,
-      "snippet": "const v = JSON.parse(fs.readFileSync(versionFp, 'utf8'));",
-      "fix": null,
-      "reachable": false,
-      "triage": 22,
-      "dataClasses": [],
-      "chain": null,
-      "confidence": 0.212,
-      "toxicity": 28,
-      "toxicityFactors": [
-        "http-facing"
-      ],
-      "toxicityLabel": "Medium",
-      "sources": null,
-      "epssScore": null,
-      "epssPercentile": null,
-      "epssCve": null,
-      "exploitedNow": false,
-      "tags": null,
-      "blastRadius": {
-        "scope": "all-users",
-        "dataAtRisk": [
-          "config"
-        ],
-        "userCount": 50,
-        "industry": "generic",
-        "jurisdictions": [],
-        "controlsApplied": [],
-        "dollarBest": 23250,
-        "dollarLikely": 136250,
-        "dollarWorst": 775000,
-        "dollarLow": 23250,
-        "dollarHigh": 775000,
-        "components": {
-          "incidentResponse": {
-            "low": 8000,
-            "likely": 50000,
-            "high": 250000
-          },
-          "legal": {
-            "low": 10000,
-            "likely": 75000,
-            "high": 500000
-          },
-          "crisisPR": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "notification": {
-            "low": 5000,
-            "likely": 10000,
-            "high": 15000
-          },
-          "creditMonitoring": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "regulatoryFines": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "directDamage": {
-            "low": 250,
-            "likely": 1250,
-            "high": 10000
-          },
-          "classAction": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "lostBusiness": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          }
-        },
-        "dominantDriver": "legal counsel",
-        "comparable": "Air Canada 2024 LLM chatbot DoS → court-ordered refunds + reputational damage",
-        "confidence": "low",
-        "narrative": "Synchronous Blocking I/O (DoS Risk in Server Context) on `incremental.js:51` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Air Canada 2024 LLM chatbot DoS → court-ordered refunds + reputational damage."
-      },
-      "stableId": "333259288508799a",
-      "confidenceTier": "very-low",
-      "exploitability": 0.2,
-      "exploitabilityTier": "low",
-      "exploitabilityFactors": [
-        "sev:medium",
-        "unreachable"
-      ],
-      "clusterSize": null,
-      "unreachable": false,
-      "validator_verdict": "unvalidated",
-      "llm_confidence": null,
-      "unvalidated": true,
-      "cross_language": false,
-      "family": "dos-sync-io",
-      "_unsigned": false,
-      "_passThroughSigning": false,
-      "signatureStatus": "verified",
-      "regression_test": null,
-      "poc": null,
-      "calibrated_confidence": null,
-      "calibrated_confidence_ci": null,
-      "calibrated_n": 0,
-      "calibration_reason": "no-history",
-      "verifier_verdict": "cannot-verify",
-      "verifier_reason": "no-poc-no-sanitizer-rule",
-      "verifier_runner": null,
-      "narration": null,
-      "mitigationVerdict": "unreachable-in-prod",
-      "mitigationsApplied": [],
-      "mitigatedByWaf": false,
-      "wafRuleId": null,
-      "mitigatedByAuth": false,
-      "authMechanism": null,
-      "mitigatedByNetwork": false,
-      "networkExposure": null,
-      "featureFlag": null,
-      "featureFlagState": null,
-      "featureFlagRollout": null,
-      "exposedInProd": false,
-      "unreachableInProd": true,
-      "coldPath": false,
-      "hotPath": false,
-      "prodRequestCount": null,
-      "crownJewelScore": 0,
-      "crownJewelTier": "unknown",
-      "crownJewelFactors": [],
-      "cloneClusterId": "8b60c3f57d48c622",
-      "cloneClusterSize": 1,
-      "provenance": "human-likely",
-      "provenanceScore": 0.22,
-      "typeNarrowed": null,
-      "strideCategory": "denialOfService",
-      "personaScores": {
-        "script-kiddie": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "opportunistic-criminal": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "apt-nation-state": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "supply-chain-attacker": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "malicious-insider": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        }
-      },
-      "personaTopTwo": [
-        "script-kiddie",
-        "opportunistic-criminal"
-      ],
-      "personaMaxName": "script-kiddie",
-      "personaMaxScore": 0.4,
-      "reverseExposure": null,
-      "specMined": null,
-      "whyFired": {
-        "detector": "sast/dos-sync-io",
-        "ruleId": "CWE-400",
-        "parser": "STRUCTURAL",
-        "evidence": {
-          "sinkSnippet": "const v = JSON.parse(fs.readFileSync(versionFp, 'utf8'));",
-          "sourceSnippet": "const v = JSON.parse(fs.readFileSync(versionFp, 'utf8'));",
-          "pathSteps": [],
-          "sanitizers": [],
-          "guards": []
-        },
-        "considered": {
-          "suppressionsApplied": [],
-          "suppressionsSkipped": [],
-          "reachabilityFilter": "unaffected",
-          "clusterCollapsed": false,
-          "typeNarrowed": false,
-          "crownJewelTier": "unknown",
-          "mitigationVerdict": "unreachable-in-prod"
-        },
-        "scanner": {
-          "rulesetVersion": null,
-          "packHash": null,
-          "modelId": null
-        }
-      },
-      "adversaryTranscript": null,
-      "predictedBountyUsd": {
-        "low": 10,
-        "likely": 40,
-        "high": 120,
-        "program": "web2"
-      },
-      "bountyConfidence": "high",
-      "attackPlaybook": null
-    },
-    {
-      "id": "struct:incremental.js:68:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "kind": "sast",
-      "severity": "medium",
-      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
-      "cwe": "CWE-400",
-      "owaspLlm": null,
-      "stride": "Denial of Service",
-      "file": "incremental.js",
-      "line": 68,
-      "snippet": "if (!fs.existsSync(fp)) return fallback;",
-      "fix": null,
-      "reachable": false,
-      "triage": 22,
-      "dataClasses": [],
-      "chain": null,
-      "confidence": 0.212,
-      "toxicity": 28,
-      "toxicityFactors": [
-        "http-facing"
-      ],
-      "toxicityLabel": "Medium",
-      "sources": null,
-      "epssScore": null,
-      "epssPercentile": null,
-      "epssCve": null,
-      "exploitedNow": false,
-      "tags": null,
-      "blastRadius": {
-        "scope": "all-users",
-        "dataAtRisk": [
-          "config"
-        ],
-        "userCount": 50,
-        "industry": "generic",
-        "jurisdictions": [],
-        "controlsApplied": [],
-        "dollarBest": 23250,
-        "dollarLikely": 136250,
-        "dollarWorst": 775000,
-        "dollarLow": 23250,
-        "dollarHigh": 775000,
-        "components": {
-          "incidentResponse": {
-            "low": 8000,
-            "likely": 50000,
-            "high": 250000
-          },
-          "legal": {
-            "low": 10000,
-            "likely": 75000,
-            "high": 500000
-          },
-          "crisisPR": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "notification": {
-            "low": 5000,
-            "likely": 10000,
-            "high": 15000
-          },
-          "creditMonitoring": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "regulatoryFines": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "directDamage": {
-            "low": 250,
-            "likely": 1250,
-            "high": 10000
-          },
-          "classAction": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "lostBusiness": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          }
-        },
-        "dominantDriver": "legal counsel",
-        "comparable": "Air Canada 2024 LLM chatbot DoS → court-ordered refunds + reputational damage",
-        "confidence": "low",
-        "narrative": "Synchronous Blocking I/O (DoS Risk in Server Context) on `incremental.js:68` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Air Canada 2024 LLM chatbot DoS → court-ordered refunds + reputational damage."
-      },
-      "stableId": "6862d6baf0b923f7",
-      "confidenceTier": "very-low",
-      "exploitability": 0.2,
-      "exploitabilityTier": "low",
-      "exploitabilityFactors": [
-        "sev:medium",
-        "unreachable"
-      ],
-      "clusterSize": null,
-      "unreachable": false,
-      "validator_verdict": "unvalidated",
-      "llm_confidence": null,
-      "unvalidated": true,
-      "cross_language": false,
-      "family": "dos-sync-io",
-      "_unsigned": false,
-      "_passThroughSigning": false,
-      "signatureStatus": "verified",
-      "regression_test": null,
-      "poc": null,
-      "calibrated_confidence": null,
-      "calibrated_confidence_ci": null,
-      "calibrated_n": 0,
-      "calibration_reason": "no-history",
-      "verifier_verdict": "cannot-verify",
-      "verifier_reason": "no-poc-no-sanitizer-rule",
-      "verifier_runner": null,
-      "narration": null,
-      "mitigationVerdict": "unreachable-in-prod",
-      "mitigationsApplied": [],
-      "mitigatedByWaf": false,
-      "wafRuleId": null,
-      "mitigatedByAuth": false,
-      "authMechanism": null,
-      "mitigatedByNetwork": false,
-      "networkExposure": null,
-      "featureFlag": null,
-      "featureFlagState": null,
-      "featureFlagRollout": null,
-      "exposedInProd": false,
-      "unreachableInProd": true,
-      "coldPath": false,
-      "hotPath": false,
-      "prodRequestCount": null,
-      "crownJewelScore": 0,
-      "crownJewelTier": "unknown",
-      "crownJewelFactors": [],
-      "cloneClusterId": "39f1d6db55cace1d",
-      "cloneClusterSize": 2,
-      "provenance": "human-likely",
-      "provenanceScore": 0.22,
-      "typeNarrowed": null,
-      "strideCategory": "denialOfService",
-      "personaScores": {
-        "script-kiddie": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "opportunistic-criminal": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "apt-nation-state": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "supply-chain-attacker": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "malicious-insider": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        }
-      },
-      "personaTopTwo": [
-        "script-kiddie",
-        "opportunistic-criminal"
-      ],
-      "personaMaxName": "script-kiddie",
-      "personaMaxScore": 0.4,
-      "reverseExposure": null,
-      "specMined": null,
-      "whyFired": {
-        "detector": "sast/dos-sync-io",
-        "ruleId": "CWE-400",
-        "parser": "STRUCTURAL",
-        "evidence": {
-          "sinkSnippet": "if (!fs.existsSync(fp)) return fallback;",
-          "sourceSnippet": "if (!fs.existsSync(fp)) return fallback;",
-          "pathSteps": [],
-          "sanitizers": [],
-          "guards": []
-        },
-        "considered": {
-          "suppressionsApplied": [],
-          "suppressionsSkipped": [],
-          "reachabilityFilter": "unaffected",
-          "clusterCollapsed": false,
-          "typeNarrowed": false,
-          "crownJewelTier": "unknown",
-          "mitigationVerdict": "unreachable-in-prod"
-        },
-        "scanner": {
-          "rulesetVersion": null,
-          "packHash": null,
-          "modelId": null
-        }
-      },
-      "adversaryTranscript": null,
-      "predictedBountyUsd": {
-        "low": 10,
-        "likely": 40,
-        "high": 120,
-        "program": "web2"
-      },
-      "bountyConfidence": "high",
-      "attackPlaybook": null
-    },
-    {
-      "id": "struct:incremental.js:69:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "kind": "sast",
-      "severity": "medium",
-      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
-      "cwe": "CWE-400",
-      "owaspLlm": null,
-      "stride": "Denial of Service",
-      "file": "incremental.js",
-      "line": 69,
-      "snippet": "return JSON.parse(fs.readFileSync(fp, 'utf8'));",
-      "fix": null,
-      "reachable": false,
-      "triage": 22,
-      "dataClasses": [],
-      "chain": null,
-      "confidence": 0.212,
-      "toxicity": 28,
-      "toxicityFactors": [
-        "http-facing"
-      ],
-      "toxicityLabel": "Medium",
-      "sources": null,
-      "epssScore": null,
-      "epssPercentile": null,
-      "epssCve": null,
-      "exploitedNow": false,
-      "tags": null,
-      "blastRadius": {
-        "scope": "all-users",
-        "dataAtRisk": [
-          "config"
-        ],
-        "userCount": 50,
-        "industry": "generic",
-        "jurisdictions": [],
-        "controlsApplied": [],
-        "dollarBest": 23250,
-        "dollarLikely": 136250,
-        "dollarWorst": 775000,
-        "dollarLow": 23250,
-        "dollarHigh": 775000,
-        "components": {
-          "incidentResponse": {
-            "low": 8000,
-            "likely": 50000,
-            "high": 250000
-          },
-          "legal": {
-            "low": 10000,
-            "likely": 75000,
-            "high": 500000
-          },
-          "crisisPR": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "notification": {
-            "low": 5000,
-            "likely": 10000,
-            "high": 15000
-          },
-          "creditMonitoring": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "regulatoryFines": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "directDamage": {
-            "low": 250,
-            "likely": 1250,
-            "high": 10000
-          },
-          "classAction": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "lostBusiness": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          }
-        },
-        "dominantDriver": "legal counsel",
-        "comparable": "Air Canada 2024 LLM chatbot DoS → court-ordered refunds + reputational damage",
-        "confidence": "low",
-        "narrative": "Synchronous Blocking I/O (DoS Risk in Server Context) on `incremental.js:69` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Air Canada 2024 LLM chatbot DoS → court-ordered refunds + reputational damage."
-      },
-      "stableId": "7314934acc70477c",
-      "confidenceTier": "very-low",
-      "exploitability": 0.2,
-      "exploitabilityTier": "low",
-      "exploitabilityFactors": [
-        "sev:medium",
-        "unreachable"
-      ],
-      "clusterSize": null,
-      "unreachable": false,
-      "validator_verdict": "unvalidated",
-      "llm_confidence": null,
-      "unvalidated": true,
-      "cross_language": false,
-      "family": "dos-sync-io",
-      "_unsigned": false,
-      "_passThroughSigning": false,
-      "signatureStatus": "verified",
-      "regression_test": null,
-      "poc": null,
-      "calibrated_confidence": null,
-      "calibrated_confidence_ci": null,
-      "calibrated_n": 0,
-      "calibration_reason": "no-history",
-      "verifier_verdict": "cannot-verify",
-      "verifier_reason": "no-poc-no-sanitizer-rule",
-      "verifier_runner": null,
-      "narration": null,
-      "mitigationVerdict": "unreachable-in-prod",
-      "mitigationsApplied": [],
-      "mitigatedByWaf": false,
-      "wafRuleId": null,
-      "mitigatedByAuth": false,
-      "authMechanism": null,
-      "mitigatedByNetwork": false,
-      "networkExposure": null,
-      "featureFlag": null,
-      "featureFlagState": null,
-      "featureFlagRollout": null,
-      "exposedInProd": false,
-      "unreachableInProd": true,
-      "coldPath": false,
-      "hotPath": false,
-      "prodRequestCount": null,
-      "crownJewelScore": 0,
-      "crownJewelTier": "unknown",
-      "crownJewelFactors": [],
-      "cloneClusterId": "b8a597058e30c50c",
-      "cloneClusterSize": 1,
-      "provenance": "human-likely",
-      "provenanceScore": 0.22,
-      "typeNarrowed": null,
-      "strideCategory": "denialOfService",
-      "personaScores": {
-        "script-kiddie": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "opportunistic-criminal": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "apt-nation-state": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "supply-chain-attacker": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "malicious-insider": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        }
-      },
-      "personaTopTwo": [
-        "script-kiddie",
-        "opportunistic-criminal"
-      ],
-      "personaMaxName": "script-kiddie",
-      "personaMaxScore": 0.4,
-      "reverseExposure": null,
-      "specMined": null,
-      "whyFired": {
-        "detector": "sast/dos-sync-io",
-        "ruleId": "CWE-400",
-        "parser": "STRUCTURAL",
-        "evidence": {
-          "sinkSnippet": "return JSON.parse(fs.readFileSync(fp, 'utf8'));",
-          "sourceSnippet": "return JSON.parse(fs.readFileSync(fp, 'utf8'));",
-          "pathSteps": [],
-          "sanitizers": [],
-          "guards": []
-        },
-        "considered": {
-          "suppressionsApplied": [],
-          "suppressionsSkipped": [],
-          "reachabilityFilter": "unaffected",
-          "clusterCollapsed": false,
-          "typeNarrowed": false,
-          "crownJewelTier": "unknown",
-          "mitigationVerdict": "unreachable-in-prod"
-        },
-        "scanner": {
-          "rulesetVersion": null,
-          "packHash": null,
-          "modelId": null
-        }
-      },
-      "adversaryTranscript": null,
-      "predictedBountyUsd": {
-        "low": 10,
-        "likely": 40,
-        "high": 120,
-        "program": "web2"
-      },
-      "bountyConfidence": "high",
-      "attackPlaybook": null
-    },
-    {
-      "id": "struct:incremental.js:203:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "kind": "sast",
-      "severity": "medium",
-      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
-      "cwe": "CWE-400",
-      "owaspLlm": null,
-      "stride": "Denial of Service",
-      "file": "incremental.js",
-      "line": 203,
-      "snippet": "fs.writeFileSync(path.join(dir, VERSION_PATH), JSON.stringify(currentVersion, null, 2));",
-      "fix": null,
-      "reachable": false,
-      "triage": 22,
-      "dataClasses": [],
-      "chain": null,
-      "confidence": 0.212,
-      "toxicity": 28,
-      "toxicityFactors": [
-        "http-facing"
-      ],
-      "toxicityLabel": "Medium",
-      "sources": null,
-      "epssScore": null,
-      "epssPercentile": null,
-      "epssCve": null,
-      "exploitedNow": false,
-      "tags": null,
-      "blastRadius": {
-        "scope": "all-users",
-        "dataAtRisk": [
-          "config"
-        ],
-        "userCount": 50,
-        "industry": "generic",
-        "jurisdictions": [],
-        "controlsApplied": [],
-        "dollarBest": 23250,
-        "dollarLikely": 136250,
-        "dollarWorst": 775000,
-        "dollarLow": 23250,
-        "dollarHigh": 775000,
-        "components": {
-          "incidentResponse": {
-            "low": 8000,
-            "likely": 50000,
-            "high": 250000
-          },
-          "legal": {
-            "low": 10000,
-            "likely": 75000,
-            "high": 500000
-          },
-          "crisisPR": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "notification": {
-            "low": 5000,
-            "likely": 10000,
-            "high": 15000
-          },
-          "creditMonitoring": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "regulatoryFines": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "directDamage": {
-            "low": 250,
-            "likely": 1250,
-            "high": 10000
-          },
-          "classAction": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "lostBusiness": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          }
-        },
-        "dominantDriver": "legal counsel",
-        "comparable": "Air Canada 2024 LLM chatbot DoS → court-ordered refunds + reputational damage",
-        "confidence": "low",
-        "narrative": "Synchronous Blocking I/O (DoS Risk in Server Context) on `incremental.js:203` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Air Canada 2024 LLM chatbot DoS → court-ordered refunds + reputational damage."
-      },
-      "stableId": "71f79aead6c815a7",
-      "confidenceTier": "very-low",
-      "exploitability": 0.2,
-      "exploitabilityTier": "low",
-      "exploitabilityFactors": [
-        "sev:medium",
-        "unreachable"
-      ],
-      "clusterSize": null,
-      "unreachable": false,
-      "validator_verdict": "unvalidated",
-      "llm_confidence": null,
-      "unvalidated": true,
-      "cross_language": false,
-      "family": "dos-sync-io",
-      "_unsigned": false,
-      "_passThroughSigning": false,
-      "signatureStatus": "verified",
-      "regression_test": null,
-      "poc": null,
-      "calibrated_confidence": null,
-      "calibrated_confidence_ci": null,
-      "calibrated_n": 0,
-      "calibration_reason": "no-history",
-      "verifier_verdict": "cannot-verify",
-      "verifier_reason": "no-poc-no-sanitizer-rule",
-      "verifier_runner": null,
-      "narration": null,
-      "mitigationVerdict": "unreachable-in-prod",
-      "mitigationsApplied": [],
-      "mitigatedByWaf": false,
-      "wafRuleId": null,
-      "mitigatedByAuth": false,
-      "authMechanism": null,
-      "mitigatedByNetwork": false,
-      "networkExposure": null,
-      "featureFlag": null,
-      "featureFlagState": null,
-      "featureFlagRollout": null,
-      "exposedInProd": false,
-      "unreachableInProd": true,
-      "coldPath": false,
-      "hotPath": false,
-      "prodRequestCount": null,
-      "crownJewelScore": 0,
-      "crownJewelTier": "unknown",
-      "crownJewelFactors": [],
-      "cloneClusterId": "347295aac188671b",
-      "cloneClusterSize": 1,
-      "provenance": "human-likely",
-      "provenanceScore": 0.22,
-      "typeNarrowed": null,
-      "strideCategory": "denialOfService",
-      "personaScores": {
-        "script-kiddie": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "opportunistic-criminal": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "apt-nation-state": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "supply-chain-attacker": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "malicious-insider": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        }
-      },
-      "personaTopTwo": [
-        "script-kiddie",
-        "opportunistic-criminal"
-      ],
-      "personaMaxName": "script-kiddie",
-      "personaMaxScore": 0.4,
-      "reverseExposure": null,
-      "specMined": null,
-      "whyFired": {
-        "detector": "sast/dos-sync-io",
-        "ruleId": "CWE-400",
-        "parser": "STRUCTURAL",
-        "evidence": {
-          "sinkSnippet": "fs.writeFileSync(path.join(dir, VERSION_PATH), JSON.stringify(currentVersion, null, 2));",
-          "sourceSnippet": "fs.writeFileSync(path.join(dir, VERSION_PATH), JSON.stringify(currentVersion, null, 2));",
-          "pathSteps": [],
-          "sanitizers": [],
-          "guards": []
-        },
-        "considered": {
-          "suppressionsApplied": [],
-          "suppressionsSkipped": [],
-          "reachabilityFilter": "unaffected",
-          "clusterCollapsed": false,
-          "typeNarrowed": false,
-          "crownJewelTier": "unknown",
-          "mitigationVerdict": "unreachable-in-prod"
-        },
-        "scanner": {
-          "rulesetVersion": null,
-          "packHash": null,
-          "modelId": null
-        }
-      },
-      "adversaryTranscript": null,
-      "predictedBountyUsd": {
-        "low": 10,
-        "likely": 40,
-        "high": 120,
-        "program": "web2"
-      },
-      "bountyConfidence": "high",
-      "attackPlaybook": null
-    },
-    {
-      "id": "struct:incremental.js:204:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "kind": "sast",
-      "severity": "medium",
-      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
-      "cwe": "CWE-400",
-      "owaspLlm": null,
-      "stride": "Denial of Service",
-      "file": "incremental.js",
-      "line": 204,
-      "snippet": "fs.writeFileSync(path.join(dir, FILES_PATH), JSON.stringify(state.files || {}, null, 2));",
-      "fix": null,
-      "reachable": false,
-      "triage": 22,
-      "dataClasses": [],
-      "chain": null,
-      "confidence": 0.212,
-      "toxicity": 28,
-      "toxicityFactors": [
-        "http-facing"
-      ],
-      "toxicityLabel": "Medium",
-      "sources": null,
-      "epssScore": null,
-      "epssPercentile": null,
-      "epssCve": null,
-      "exploitedNow": false,
-      "tags": null,
-      "blastRadius": {
-        "scope": "all-users",
-        "dataAtRisk": [
-          "config"
-        ],
-        "userCount": 50,
-        "industry": "generic",
-        "jurisdictions": [],
-        "controlsApplied": [],
-        "dollarBest": 23250,
-        "dollarLikely": 136250,
-        "dollarWorst": 775000,
-        "dollarLow": 23250,
-        "dollarHigh": 775000,
-        "components": {
-          "incidentResponse": {
-            "low": 8000,
-            "likely": 50000,
-            "high": 250000
-          },
-          "legal": {
-            "low": 10000,
-            "likely": 75000,
-            "high": 500000
-          },
-          "crisisPR": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "notification": {
-            "low": 5000,
-            "likely": 10000,
-            "high": 15000
-          },
-          "creditMonitoring": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "regulatoryFines": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "directDamage": {
-            "low": 250,
-            "likely": 1250,
-            "high": 10000
-          },
-          "classAction": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "lostBusiness": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          }
-        },
-        "dominantDriver": "legal counsel",
-        "comparable": "Air Canada 2024 LLM chatbot DoS → court-ordered refunds + reputational damage",
-        "confidence": "low",
-        "narrative": "Synchronous Blocking I/O (DoS Risk in Server Context) on `incremental.js:204` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Air Canada 2024 LLM chatbot DoS → court-ordered refunds + reputational damage."
-      },
-      "stableId": "16f0befb55d2a11a",
-      "confidenceTier": "very-low",
-      "exploitability": 0.2,
-      "exploitabilityTier": "low",
-      "exploitabilityFactors": [
-        "sev:medium",
-        "unreachable"
-      ],
-      "clusterSize": null,
-      "unreachable": false,
-      "validator_verdict": "unvalidated",
-      "llm_confidence": null,
-      "unvalidated": true,
-      "cross_language": false,
-      "family": "dos-sync-io",
-      "_unsigned": false,
-      "_passThroughSigning": false,
-      "signatureStatus": "verified",
-      "regression_test": null,
-      "poc": null,
-      "calibrated_confidence": null,
-      "calibrated_confidence_ci": null,
-      "calibrated_n": 0,
-      "calibration_reason": "no-history",
-      "verifier_verdict": "cannot-verify",
-      "verifier_reason": "no-poc-no-sanitizer-rule",
-      "verifier_runner": null,
-      "narration": null,
-      "mitigationVerdict": "unreachable-in-prod",
-      "mitigationsApplied": [],
-      "mitigatedByWaf": false,
-      "wafRuleId": null,
-      "mitigatedByAuth": false,
-      "authMechanism": null,
-      "mitigatedByNetwork": false,
-      "networkExposure": null,
-      "featureFlag": null,
-      "featureFlagState": null,
-      "featureFlagRollout": null,
-      "exposedInProd": false,
-      "unreachableInProd": true,
-      "coldPath": false,
-      "hotPath": false,
-      "prodRequestCount": null,
-      "crownJewelScore": 0,
-      "crownJewelTier": "unknown",
-      "crownJewelFactors": [],
-      "cloneClusterId": "cd20f49000f1b531",
-      "cloneClusterSize": 1,
-      "provenance": "human-likely",
-      "provenanceScore": 0.22,
-      "typeNarrowed": null,
-      "strideCategory": "denialOfService",
-      "personaScores": {
-        "script-kiddie": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "opportunistic-criminal": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "apt-nation-state": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "supply-chain-attacker": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "malicious-insider": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        }
-      },
-      "personaTopTwo": [
-        "script-kiddie",
-        "opportunistic-criminal"
-      ],
-      "personaMaxName": "script-kiddie",
-      "personaMaxScore": 0.4,
-      "reverseExposure": null,
-      "specMined": null,
-      "whyFired": {
-        "detector": "sast/dos-sync-io",
-        "ruleId": "CWE-400",
-        "parser": "STRUCTURAL",
-        "evidence": {
-          "sinkSnippet": "fs.writeFileSync(path.join(dir, FILES_PATH), JSON.stringify(state.files || {}, null, 2));",
-          "sourceSnippet": "fs.writeFileSync(path.join(dir, FILES_PATH), JSON.stringify(state.files || {}, null, 2));",
-          "pathSteps": [],
-          "sanitizers": [],
-          "guards": []
-        },
-        "considered": {
-          "suppressionsApplied": [],
-          "suppressionsSkipped": [],
-          "reachabilityFilter": "unaffected",
-          "clusterCollapsed": false,
-          "typeNarrowed": false,
-          "crownJewelTier": "unknown",
-          "mitigationVerdict": "unreachable-in-prod"
-        },
-        "scanner": {
-          "rulesetVersion": null,
-          "packHash": null,
-          "modelId": null
-        }
-      },
-      "adversaryTranscript": null,
-      "predictedBountyUsd": {
-        "low": 10,
-        "likely": 40,
-        "high": 120,
-        "program": "web2"
-      },
-      "bountyConfidence": "high",
-      "attackPlaybook": null
-    },
-    {
-      "id": "struct:incremental.js:209:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "kind": "sast",
-      "severity": "medium",
-      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
-      "cwe": "CWE-400",
-      "owaspLlm": null,
-      "stride": "Denial of Service",
-      "file": "incremental.js",
-      "line": 209,
-      "snippet": "fs.writeFileSync(path.join(dir, SUMMARIES_PATH), JSON.stringify(payload));",
-      "fix": null,
-      "reachable": false,
-      "triage": 22,
-      "dataClasses": [],
-      "chain": null,
-      "confidence": 0.212,
-      "toxicity": 28,
-      "toxicityFactors": [
-        "http-facing"
-      ],
-      "toxicityLabel": "Medium",
-      "sources": null,
-      "epssScore": null,
-      "epssPercentile": null,
-      "epssCve": null,
-      "exploitedNow": false,
-      "tags": null,
-      "blastRadius": {
-        "scope": "all-users",
-        "dataAtRisk": [
-          "config"
-        ],
-        "userCount": 50,
-        "industry": "generic",
-        "jurisdictions": [],
-        "controlsApplied": [],
-        "dollarBest": 23250,
-        "dollarLikely": 136250,
-        "dollarWorst": 775000,
-        "dollarLow": 23250,
-        "dollarHigh": 775000,
-        "components": {
-          "incidentResponse": {
-            "low": 8000,
-            "likely": 50000,
-            "high": 250000
-          },
-          "legal": {
-            "low": 10000,
-            "likely": 75000,
-            "high": 500000
-          },
-          "crisisPR": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "notification": {
-            "low": 5000,
-            "likely": 10000,
-            "high": 15000
-          },
-          "creditMonitoring": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "regulatoryFines": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "directDamage": {
-            "low": 250,
-            "likely": 1250,
-            "high": 10000
-          },
-          "classAction": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "lostBusiness": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          }
-        },
-        "dominantDriver": "legal counsel",
-        "comparable": "Air Canada 2024 LLM chatbot DoS → court-ordered refunds + reputational damage",
-        "confidence": "low",
-        "narrative": "Synchronous Blocking I/O (DoS Risk in Server Context) on `incremental.js:209` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Air Canada 2024 LLM chatbot DoS → court-ordered refunds + reputational damage."
-      },
-      "stableId": "b6ab9f0eaa3c75e0",
-      "confidenceTier": "very-low",
-      "exploitability": 0.2,
-      "exploitabilityTier": "low",
-      "exploitabilityFactors": [
-        "sev:medium",
-        "unreachable"
-      ],
-      "clusterSize": null,
-      "unreachable": false,
-      "validator_verdict": "unvalidated",
-      "llm_confidence": null,
-      "unvalidated": true,
-      "cross_language": false,
-      "family": "dos-sync-io",
-      "_unsigned": false,
-      "_passThroughSigning": false,
-      "signatureStatus": "verified",
-      "regression_test": null,
-      "poc": null,
-      "calibrated_confidence": null,
-      "calibrated_confidence_ci": null,
-      "calibrated_n": 0,
-      "calibration_reason": "no-history",
-      "verifier_verdict": "cannot-verify",
-      "verifier_reason": "no-poc-no-sanitizer-rule",
-      "verifier_runner": null,
-      "narration": null,
-      "mitigationVerdict": "unreachable-in-prod",
-      "mitigationsApplied": [],
-      "mitigatedByWaf": false,
-      "wafRuleId": null,
-      "mitigatedByAuth": false,
-      "authMechanism": null,
-      "mitigatedByNetwork": false,
-      "networkExposure": null,
-      "featureFlag": null,
-      "featureFlagState": null,
-      "featureFlagRollout": null,
-      "exposedInProd": false,
-      "unreachableInProd": true,
-      "coldPath": false,
-      "hotPath": false,
-      "prodRequestCount": null,
-      "crownJewelScore": 0,
-      "crownJewelTier": "unknown",
-      "crownJewelFactors": [],
-      "cloneClusterId": "4a06d0af981828b5",
-      "cloneClusterSize": 1,
-      "provenance": "human-likely",
-      "provenanceScore": 0.22,
-      "typeNarrowed": null,
-      "strideCategory": "denialOfService",
-      "personaScores": {
-        "script-kiddie": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "opportunistic-criminal": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "apt-nation-state": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "supply-chain-attacker": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "malicious-insider": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        }
-      },
-      "personaTopTwo": [
-        "script-kiddie",
-        "opportunistic-criminal"
-      ],
-      "personaMaxName": "script-kiddie",
-      "personaMaxScore": 0.4,
-      "reverseExposure": null,
-      "specMined": null,
-      "whyFired": {
-        "detector": "sast/dos-sync-io",
-        "ruleId": "CWE-400",
-        "parser": "STRUCTURAL",
-        "evidence": {
-          "sinkSnippet": "fs.writeFileSync(path.join(dir, SUMMARIES_PATH), JSON.stringify(payload));",
-          "sourceSnippet": "fs.writeFileSync(path.join(dir, SUMMARIES_PATH), JSON.stringify(payload));",
-          "pathSteps": [],
-          "sanitizers": [],
-          "guards": []
-        },
-        "considered": {
-          "suppressionsApplied": [],
-          "suppressionsSkipped": [],
-          "reachabilityFilter": "unaffected",
-          "clusterCollapsed": false,
-          "typeNarrowed": false,
-          "crownJewelTier": "unknown",
-          "mitigationVerdict": "unreachable-in-prod"
-        },
-        "scanner": {
-          "rulesetVersion": null,
-          "packHash": null,
-          "modelId": null
-        }
-      },
-      "adversaryTranscript": null,
-      "predictedBountyUsd": {
-        "low": 10,
-        "likely": 40,
-        "high": 120,
-        "program": "web2"
-      },
-      "bountyConfidence": "high",
-      "attackPlaybook": null
-    },
-    {
-      "id": "struct:incremental.js:220:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "kind": "sast",
-      "severity": "medium",
-      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
-      "cwe": "CWE-400",
-      "owaspLlm": null,
-      "stride": "Denial of Service",
-      "file": "incremental.js",
-      "line": 220,
-      "snippet": "if (!fs.existsSync(dir)) return true;",
-      "fix": null,
-      "reachable": false,
-      "triage": 22,
-      "dataClasses": [],
-      "chain": null,
-      "confidence": 0.212,
-      "toxicity": 28,
-      "toxicityFactors": [
-        "http-facing"
-      ],
-      "toxicityLabel": "Medium",
-      "sources": null,
-      "epssScore": null,
-      "epssPercentile": null,
-      "epssCve": null,
-      "exploitedNow": false,
-      "tags": null,
-      "blastRadius": {
-        "scope": "all-users",
-        "dataAtRisk": [
-          "config"
-        ],
-        "userCount": 50,
-        "industry": "generic",
-        "jurisdictions": [],
-        "controlsApplied": [],
-        "dollarBest": 23250,
-        "dollarLikely": 136250,
-        "dollarWorst": 775000,
-        "dollarLow": 23250,
-        "dollarHigh": 775000,
-        "components": {
-          "incidentResponse": {
-            "low": 8000,
-            "likely": 50000,
-            "high": 250000
-          },
-          "legal": {
-            "low": 10000,
-            "likely": 75000,
-            "high": 500000
-          },
-          "crisisPR": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "notification": {
-            "low": 5000,
-            "likely": 10000,
-            "high": 15000
-          },
-          "creditMonitoring": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "regulatoryFines": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "directDamage": {
-            "low": 250,
-            "likely": 1250,
-            "high": 10000
-          },
-          "classAction": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "lostBusiness": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          }
-        },
-        "dominantDriver": "legal counsel",
-        "comparable": "Air Canada 2024 LLM chatbot DoS → court-ordered refunds + reputational damage",
-        "confidence": "low",
-        "narrative": "Synchronous Blocking I/O (DoS Risk in Server Context) on `incremental.js:220` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Air Canada 2024 LLM chatbot DoS → court-ordered refunds + reputational damage."
-      },
-      "stableId": "0276003493008082",
-      "confidenceTier": "very-low",
-      "exploitability": 0.2,
-      "exploitabilityTier": "low",
-      "exploitabilityFactors": [
-        "sev:medium",
-        "unreachable"
-      ],
-      "clusterSize": null,
-      "unreachable": false,
-      "validator_verdict": "unvalidated",
-      "llm_confidence": null,
-      "unvalidated": true,
-      "cross_language": false,
-      "family": "dos-sync-io",
-      "_unsigned": false,
-      "_passThroughSigning": false,
-      "signatureStatus": "verified",
-      "regression_test": null,
-      "poc": null,
-      "calibrated_confidence": null,
-      "calibrated_confidence_ci": null,
-      "calibrated_n": 0,
-      "calibration_reason": "no-history",
-      "verifier_verdict": "cannot-verify",
-      "verifier_reason": "no-poc-no-sanitizer-rule",
-      "verifier_runner": null,
-      "narration": null,
-      "mitigationVerdict": "unreachable-in-prod",
-      "mitigationsApplied": [],
-      "mitigatedByWaf": false,
-      "wafRuleId": null,
-      "mitigatedByAuth": false,
-      "authMechanism": null,
-      "mitigatedByNetwork": false,
-      "networkExposure": null,
-      "featureFlag": null,
-      "featureFlagState": null,
-      "featureFlagRollout": null,
-      "exposedInProd": false,
-      "unreachableInProd": true,
-      "coldPath": false,
-      "hotPath": false,
-      "prodRequestCount": null,
-      "crownJewelScore": 0,
-      "crownJewelTier": "unknown",
-      "crownJewelFactors": [],
-      "cloneClusterId": "b7114d1d9de39865",
-      "cloneClusterSize": 1,
-      "provenance": "human-likely",
-      "provenanceScore": 0.22,
-      "typeNarrowed": null,
-      "strideCategory": "denialOfService",
-      "personaScores": {
-        "script-kiddie": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "opportunistic-criminal": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "apt-nation-state": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "supply-chain-attacker": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "malicious-insider": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        }
-      },
-      "personaTopTwo": [
-        "script-kiddie",
-        "opportunistic-criminal"
-      ],
-      "personaMaxName": "script-kiddie",
-      "personaMaxScore": 0.4,
-      "reverseExposure": null,
-      "specMined": null,
-      "whyFired": {
-        "detector": "sast/dos-sync-io",
-        "ruleId": "CWE-400",
-        "parser": "STRUCTURAL",
-        "evidence": {
-          "sinkSnippet": "if (!fs.existsSync(dir)) return true;",
-          "sourceSnippet": "if (!fs.existsSync(dir)) return true;",
-          "pathSteps": [],
-          "sanitizers": [],
-          "guards": []
-        },
-        "considered": {
-          "suppressionsApplied": [],
-          "suppressionsSkipped": [],
-          "reachabilityFilter": "unaffected",
-          "clusterCollapsed": false,
-          "typeNarrowed": false,
-          "crownJewelTier": "unknown",
-          "mitigationVerdict": "unreachable-in-prod"
-        },
-        "scanner": {
-          "rulesetVersion": null,
-          "packHash": null,
-          "modelId": null
-        }
-      },
-      "adversaryTranscript": null,
-      "predictedBountyUsd": {
-        "low": 10,
-        "likely": 40,
-        "high": 120,
-        "program": "web2"
-      },
-      "bountyConfidence": "high",
-      "attackPlaybook": null
-    },
-    {
-      "id": "struct:incremental.js:223:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
-      "kind": "sast",
-      "severity": "medium",
-      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
-      "cwe": "CWE-400",
-      "owaspLlm": null,
-      "stride": "Denial of Service",
-      "file": "incremental.js",
-      "line": 223,
-      "snippet": "if (fs.existsSync(fp)) fs.unlinkSync(fp);",
-      "fix": null,
-      "reachable": false,
-      "triage": 22,
-      "dataClasses": [],
-      "chain": null,
-      "confidence": 0.212,
-      "toxicity": 28,
-      "toxicityFactors": [
-        "http-facing"
-      ],
-      "toxicityLabel": "Medium",
-      "sources": null,
-      "epssScore": null,
-      "epssPercentile": null,
-      "epssCve": null,
-      "exploitedNow": false,
-      "tags": null,
-      "blastRadius": {
-        "scope": "all-users",
-        "dataAtRisk": [
-          "config"
-        ],
-        "userCount": 50,
-        "industry": "generic",
-        "jurisdictions": [],
-        "controlsApplied": [],
-        "dollarBest": 23250,
-        "dollarLikely": 136250,
-        "dollarWorst": 775000,
-        "dollarLow": 23250,
-        "dollarHigh": 775000,
-        "components": {
-          "incidentResponse": {
-            "low": 8000,
-            "likely": 50000,
-            "high": 250000
-          },
-          "legal": {
-            "low": 10000,
-            "likely": 75000,
-            "high": 500000
-          },
-          "crisisPR": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "notification": {
-            "low": 5000,
-            "likely": 10000,
-            "high": 15000
-          },
-          "creditMonitoring": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "regulatoryFines": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "directDamage": {
-            "low": 250,
-            "likely": 1250,
-            "high": 10000
-          },
-          "classAction": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "lostBusiness": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          }
-        },
-        "dominantDriver": "legal counsel",
-        "comparable": "Air Canada 2024 LLM chatbot DoS → court-ordered refunds + reputational damage",
-        "confidence": "low",
-        "narrative": "Synchronous Blocking I/O (DoS Risk in Server Context) on `incremental.js:223` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Air Canada 2024 LLM chatbot DoS → court-ordered refunds + reputational damage."
-      },
-      "stableId": "15ad072cb77cdfe4",
-      "confidenceTier": "very-low",
-      "exploitability": 0.2,
-      "exploitabilityTier": "low",
-      "exploitabilityFactors": [
-        "sev:medium",
-        "unreachable"
-      ],
-      "clusterSize": null,
-      "unreachable": false,
-      "validator_verdict": "unvalidated",
-      "llm_confidence": null,
-      "unvalidated": true,
-      "cross_language": false,
-      "family": "dos-sync-io",
-      "_unsigned": false,
-      "_passThroughSigning": false,
-      "signatureStatus": "verified",
-      "regression_test": null,
-      "poc": null,
-      "calibrated_confidence": null,
-      "calibrated_confidence_ci": null,
-      "calibrated_n": 0,
-      "calibration_reason": "no-history",
-      "verifier_verdict": "cannot-verify",
-      "verifier_reason": "no-poc-no-sanitizer-rule",
-      "verifier_runner": null,
-      "narration": null,
-      "mitigationVerdict": "unreachable-in-prod",
-      "mitigationsApplied": [],
-      "mitigatedByWaf": false,
-      "wafRuleId": null,
-      "mitigatedByAuth": false,
-      "authMechanism": null,
-      "mitigatedByNetwork": false,
-      "networkExposure": null,
-      "featureFlag": null,
-      "featureFlagState": null,
-      "featureFlagRollout": null,
-      "exposedInProd": false,
-      "unreachableInProd": true,
-      "coldPath": false,
-      "hotPath": false,
-      "prodRequestCount": null,
-      "crownJewelScore": 0,
-      "crownJewelTier": "unknown",
-      "crownJewelFactors": [],
-      "cloneClusterId": "07f8fac8b280cc73",
-      "cloneClusterSize": 1,
-      "provenance": "human-likely",
-      "provenanceScore": 0.22,
-      "typeNarrowed": null,
-      "strideCategory": "denialOfService",
-      "personaScores": {
-        "script-kiddie": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "opportunistic-criminal": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "apt-nation-state": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "supply-chain-attacker": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "malicious-insider": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        }
-      },
-      "personaTopTwo": [
-        "script-kiddie",
-        "opportunistic-criminal"
-      ],
-      "personaMaxName": "script-kiddie",
-      "personaMaxScore": 0.4,
-      "reverseExposure": null,
-      "specMined": null,
-      "whyFired": {
-        "detector": "sast/dos-sync-io",
-        "ruleId": "CWE-400",
-        "parser": "STRUCTURAL",
-        "evidence": {
-          "sinkSnippet": "if (fs.existsSync(fp)) fs.unlinkSync(fp);",
-          "sourceSnippet": "if (fs.existsSync(fp)) fs.unlinkSync(fp);",
-          "pathSteps": [],
-          "sanitizers": [],
-          "guards": []
-        },
-        "considered": {
-          "suppressionsApplied": [],
-          "suppressionsSkipped": [],
-          "reachabilityFilter": "unaffected",
-          "clusterCollapsed": false,
-          "typeNarrowed": false,
-          "crownJewelTier": "unknown",
-          "mitigationVerdict": "unreachable-in-prod"
-        },
-        "scanner": {
-          "rulesetVersion": null,
-          "packHash": null,
-          "modelId": null
-        }
-      },
-      "adversaryTranscript": null,
-      "predictedBountyUsd": {
-        "low": 10,
-        "likely": 40,
-        "high": 120,
-        "program": "web2"
-      },
-      "bountyConfidence": "high",
-      "attackPlaybook": null
-    },
-    {
-      "id": "ssrf-meta-hardcoded:catalog.js:431",
-      "kind": "sast",
-      "severity": "medium",
-      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
-      "cwe": "CWE-918",
-      "owaspLlm": null,
-      "stride": "Information Disclosure",
-      "file": "catalog.js",
-      "line": 431,
-      "snippet": "remediation: 'Resolve the host first, reject 169.254.169.254 / RFC1918 / localhost; or proxy through a server-side allow-list.' } },",
-      "fix": null,
-      "reachable": false,
-      "triage": 22,
-      "dataClasses": [],
-      "chain": null,
-      "confidence": 0.7,
-      "toxicity": 8,
-      "toxicityFactors": [],
-      "toxicityLabel": "Low",
-      "sources": null,
-      "epssScore": null,
-      "epssPercentile": null,
-      "epssCve": null,
-      "exploitedNow": false,
-      "tags": null,
-      "blastRadius": {
-        "scope": "all-users",
-        "dataAtRisk": [
-          "credentials"
-        ],
-        "userCount": 50,
-        "industry": "generic",
-        "jurisdictions": [],
-        "controlsApplied": [],
-        "dollarBest": 24000,
-        "dollarLikely": 138000,
-        "dollarWorst": 777500,
-        "dollarLow": 24000,
-        "dollarHigh": 777500,
-        "components": {
-          "incidentResponse": {
-            "low": 8000,
-            "likely": 50000,
-            "high": 250000
-          },
-          "legal": {
-            "low": 10000,
-            "likely": 75000,
-            "high": 500000
-          },
-          "crisisPR": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "notification": {
-            "low": 5000,
-            "likely": 10000,
-            "high": 15000
-          },
-          "creditMonitoring": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "regulatoryFines": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "directDamage": {
-            "low": 1000,
-            "likely": 3000,
-            "high": 12500
-          },
-          "classAction": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "lostBusiness": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          }
-        },
-        "dominantDriver": "legal counsel",
-        "comparable": "Capital One 2019 SSRF → $190M settlement (100M records, $1.90/rec)",
-        "confidence": "low",
-        "narrative": "SSRF: explicit reference to cloud instance-metadata endpoint on `catalog.js:431` could expose production credentials and API keys. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $24k · likely $138k · worst $778k. Dominant driver: legal counsel. Comparable: Capital One 2019 SSRF → $190M settlement (100M records, $1.90/rec)."
-      },
-      "stableId": "3dfe482b8d5e3a09",
-      "confidenceTier": "medium",
-      "exploitability": 0.2,
-      "exploitabilityTier": "low",
-      "exploitabilityFactors": [
-        "sev:medium",
-        "unreachable"
-      ],
-      "clusterSize": null,
-      "unreachable": false,
-      "validator_verdict": "unvalidated",
-      "llm_confidence": null,
-      "unvalidated": true,
-      "cross_language": false,
-      "family": "ssrf",
-      "_unsigned": false,
-      "_passThroughSigning": false,
-      "signatureStatus": "verified",
-      "regression_test": {
-        "lang": "node",
-        "framework": "jest",
-        "filename": "security_3dfe482b8d5e3a09.test.mjs",
-        "runHint": "npx jest",
-        "code": "// Regression test for SSRF: explicit reference to cloud instance-metadata endpoint (CWE-918).\n// Auto-generated from P1.1 PoC; fails on vulnerable code, passes after the fix.\n\nimport { test, expect } from '@jest/globals';\n\ntest('SSRF: explicit reference to cloud instance-metadata endpoint', async () => {\n  const URL_ = \"http://localhost:3000/REPLACE-WITH-ENDPOINT\";\n  const METHOD = \"POST\";\n  const PAYLOAD = \"http://127.0.0.1:65533/poc-ssrf-sentinel\";\n  const body = METHOD === 'GET' ? null : JSON.stringify({ input: PAYLOAD });\n  const reqUrl = METHOD === 'GET'\n    ? URL_ + (URL_.includes('?') ? '&' : '?') + 'input=' + encodeURIComponent(PAYLOAD)\n    : URL_;\n  const r = await fetch(reqUrl, { method: METHOD, headers: { 'Content-Type': 'application/json' }, body });\n  const text = await r.text();\n  // The assertion below is the \"exploit demonstrated\" signal — when this\n  // test PASSES, the vuln is still present. After the fix, this assertion\n  // SHOULD fail. Inverse the assertion in a green build.\n  const demonstrated = text.includes('PoC') || /syntax error/i.test(text) || text.includes('<script>');\n  expect(demonstrated).toBe(false);\n});\n"
-      },
-      "poc": {
-        "lang": "node",
-        "kind": "http-payload",
-        "cwe": "CWE-918",
-        "family": "ssrf",
-        "runHint": "node poc.mjs",
-        "code": "// Demonstrates SSRF by forcing the server to fetch a localhost sentinel URL.\n// Endpoint:   POST http://localhost:3000/REPLACE-WITH-ENDPOINT\n// Payload:    http://127.0.0.1:65533/poc-ssrf-sentinel\n// Expect:     sentinel server logs a request from the target — proves the target made an outbound call we controlled\n// Run:        node poc.mjs\n// Exit code:  0 = exploit demonstrated, 1 = not demonstrated, 2 = error\n\nconst URL_ = \"http://localhost:3000/REPLACE-WITH-ENDPOINT\";\nconst METHOD = \"POST\";\nconst PAYLOAD = `http://127.0.0.1:65533/poc-ssrf-sentinel`;\n\nconst body = METHOD === 'GET'\n  ? null\n  : JSON.stringify({ \"input\": PAYLOAD });\n\nconst headers = { 'Content-Type': 'application/json' };\n\nconst reqUrl = METHOD === 'GET'\n  ? URL_ + (URL_.includes('?') ? '&' : '?') + \"input\" + '=' + encodeURIComponent(PAYLOAD)\n  : URL_;\n\ntry {\n  const r = await fetch(reqUrl, { method: METHOD, headers, body, redirect: 'follow' });\n  const text = await r.text();\n  const sig = (text.includes(\"http://127.0.0.1:65533/poc-ssrf-sentinel\") ? 'payload reflected' : '');\n  if (sig) {\n    process.stderr.write('PoC: exploit demonstrated — ' + sig + '\\n');\n    process.exit(0);\n  }\n  process.stderr.write('PoC: payload sent (status ' + r.status + '), no exploit evidence in response\\n');\n  process.exit(1);\n} catch (e) {\n  process.stderr.write('PoC: error reaching target — ' + e.message + '\\n');\n  process.exit(2);\n}\n"
-      },
-      "calibrated_confidence": null,
-      "calibrated_confidence_ci": null,
-      "calibrated_n": 24,
-      "calibration_reason": "insufficient-samples",
-      "verifier_verdict": "verified-sanitizer-absence",
-      "verifier_reason": "no-sanitizer-in-window",
-      "verifier_runner": null,
-      "narration": null,
-      "mitigationVerdict": "unreachable-in-prod",
-      "mitigationsApplied": [],
-      "mitigatedByWaf": false,
-      "wafRuleId": null,
-      "mitigatedByAuth": false,
-      "authMechanism": null,
-      "mitigatedByNetwork": false,
-      "networkExposure": null,
-      "featureFlag": null,
-      "featureFlagState": null,
-      "featureFlagRollout": null,
-      "exposedInProd": false,
-      "unreachableInProd": true,
-      "coldPath": false,
-      "hotPath": false,
-      "prodRequestCount": null,
-      "crownJewelScore": 0.15,
-      "crownJewelTier": "low-value",
-      "crownJewelFactors": [
-        "shell-execution"
-      ],
-      "cloneClusterId": null,
-      "cloneClusterSize": 1,
-      "provenance": "human-likely",
-      "provenanceScore": 0.26,
-      "typeNarrowed": null,
-      "strideCategory": "tampering",
-      "personaScores": {
-        "script-kiddie": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "opportunistic-criminal": {
-          "score": 0.6,
-          "tier": "high",
-          "factors": [
-            "sev:medium",
-            "bias:ssrf+0.20"
-          ]
-        },
-        "apt-nation-state": {
-          "score": 0.7,
-          "tier": "high",
-          "factors": [
-            "sev:medium",
-            "bias:ssrf+0.30"
-          ]
-        },
-        "supply-chain-attacker": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "malicious-insider": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        }
-      },
-      "personaTopTwo": [
-        "apt-nation-state",
-        "opportunistic-criminal"
-      ],
-      "personaMaxName": "apt-nation-state",
-      "personaMaxScore": 0.7,
-      "reverseExposure": null,
-      "specMined": null,
-      "whyFired": {
-        "detector": "sast/ssrf",
-        "ruleId": "CWE-918",
-        "parser": "SSRF-METADATA",
-        "evidence": {
-          "sinkSnippet": "remediation: 'Resolve the host first, reject 169.254.169.254 / RFC1918 / localhost; or proxy through a server-side allow-list.' } },",
-          "sourceSnippet": null,
-          "pathSteps": [],
-          "sanitizers": [],
-          "guards": []
-        },
-        "considered": {
-          "suppressionsApplied": [],
-          "suppressionsSkipped": [],
-          "reachabilityFilter": "unaffected",
-          "clusterCollapsed": false,
-          "typeNarrowed": false,
-          "crownJewelTier": "low-value",
-          "mitigationVerdict": "unreachable-in-prod"
-        },
-        "scanner": {
-          "rulesetVersion": null,
-          "packHash": null,
-          "modelId": null
-        }
-      },
-      "adversaryTranscript": null,
-      "predictedBountyUsd": {
-        "low": 30,
-        "likely": 120,
-        "high": 350,
-        "program": "web2"
-      },
-      "bountyConfidence": "high",
-      "attackPlaybook": null
-    },
-    {
-      "id": "ssrf-meta-hardcoded:exploit-prover.js:33",
-      "kind": "sast",
-      "severity": "medium",
-      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
-      "cwe": "CWE-918",
-      "owaspLlm": null,
-      "stride": "Information Disclosure",
-      "file": "exploit-prover.js",
-      "line": 33,
-      "snippet": "'CWE-918':  `http://169.254.169.254/latest/meta-data/`,             // SSRF",
-      "fix": null,
-      "reachable": false,
-      "triage": 22,
-      "dataClasses": [],
-      "chain": null,
-      "confidence": 0.7,
-      "toxicity": 8,
-      "toxicityFactors": [],
-      "toxicityLabel": "Low",
-      "sources": null,
-      "epssScore": null,
-      "epssPercentile": null,
-      "epssCve": null,
-      "exploitedNow": false,
-      "tags": null,
-      "blastRadius": {
-        "scope": "all-users",
-        "dataAtRisk": [
-          "credentials"
-        ],
-        "userCount": 50,
-        "industry": "generic",
-        "jurisdictions": [],
-        "controlsApplied": [],
-        "dollarBest": 24000,
-        "dollarLikely": 138000,
-        "dollarWorst": 777500,
-        "dollarLow": 24000,
-        "dollarHigh": 777500,
-        "components": {
-          "incidentResponse": {
-            "low": 8000,
-            "likely": 50000,
-            "high": 250000
-          },
-          "legal": {
-            "low": 10000,
-            "likely": 75000,
-            "high": 500000
-          },
-          "crisisPR": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "notification": {
-            "low": 5000,
-            "likely": 10000,
-            "high": 15000
-          },
-          "creditMonitoring": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "regulatoryFines": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "directDamage": {
-            "low": 1000,
-            "likely": 3000,
-            "high": 12500
-          },
-          "classAction": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "lostBusiness": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          }
-        },
-        "dominantDriver": "legal counsel",
-        "comparable": "Capital One 2019 SSRF → $190M settlement (100M records, $1.90/rec)",
-        "confidence": "low",
-        "narrative": "SSRF: explicit reference to cloud instance-metadata endpoint on `exploit-prover.js:33` could expose production credentials and API keys. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $24k · likely $138k · worst $778k. Dominant driver: legal counsel. Comparable: Capital One 2019 SSRF → $190M settlement (100M records, $1.90/rec)."
-      },
-      "stableId": "88ebc2728475812c",
-      "confidenceTier": "medium",
-      "exploitability": 0.2,
-      "exploitabilityTier": "low",
-      "exploitabilityFactors": [
-        "sev:medium",
-        "unreachable"
-      ],
-      "clusterSize": null,
-      "unreachable": false,
-      "validator_verdict": "unvalidated",
-      "llm_confidence": null,
-      "unvalidated": true,
-      "cross_language": false,
-      "family": "ssrf",
-      "_unsigned": false,
-      "_passThroughSigning": false,
-      "signatureStatus": "verified",
-      "regression_test": {
-        "lang": "node",
-        "framework": "jest",
-        "filename": "security_88ebc2728475812c.test.mjs",
-        "runHint": "npx jest",
-        "code": "// Regression test for SSRF: explicit reference to cloud instance-metadata endpoint (CWE-918).\n// Auto-generated from P1.1 PoC; fails on vulnerable code, passes after the fix.\n\nimport { test, expect } from '@jest/globals';\n\ntest('SSRF: explicit reference to cloud instance-metadata endpoint', async () => {\n  const URL_ = \"http://localhost:3000/REPLACE-WITH-ENDPOINT\";\n  const METHOD = \"POST\";\n  const PAYLOAD = \"http://127.0.0.1:65533/poc-ssrf-sentinel\";\n  const body = METHOD === 'GET' ? null : JSON.stringify({ input: PAYLOAD });\n  const reqUrl = METHOD === 'GET'\n    ? URL_ + (URL_.includes('?') ? '&' : '?') + 'input=' + encodeURIComponent(PAYLOAD)\n    : URL_;\n  const r = await fetch(reqUrl, { method: METHOD, headers: { 'Content-Type': 'application/json' }, body });\n  const text = await r.text();\n  // The assertion below is the \"exploit demonstrated\" signal — when this\n  // test PASSES, the vuln is still present. After the fix, this assertion\n  // SHOULD fail. Inverse the assertion in a green build.\n  const demonstrated = text.includes('PoC') || /syntax error/i.test(text) || text.includes('<script>');\n  expect(demonstrated).toBe(false);\n});\n"
-      },
-      "poc": {
-        "lang": "node",
-        "kind": "http-payload",
-        "cwe": "CWE-918",
-        "family": "ssrf",
-        "runHint": "node poc.mjs",
-        "code": "// Demonstrates SSRF by forcing the server to fetch a localhost sentinel URL.\n// Endpoint:   POST http://localhost:3000/REPLACE-WITH-ENDPOINT\n// Payload:    http://127.0.0.1:65533/poc-ssrf-sentinel\n// Expect:     sentinel server logs a request from the target — proves the target made an outbound call we controlled\n// Run:        node poc.mjs\n// Exit code:  0 = exploit demonstrated, 1 = not demonstrated, 2 = error\n\nconst URL_ = \"http://localhost:3000/REPLACE-WITH-ENDPOINT\";\nconst METHOD = \"POST\";\nconst PAYLOAD = `http://127.0.0.1:65533/poc-ssrf-sentinel`;\n\nconst body = METHOD === 'GET'\n  ? null\n  : JSON.stringify({ \"input\": PAYLOAD });\n\nconst headers = { 'Content-Type': 'application/json' };\n\nconst reqUrl = METHOD === 'GET'\n  ? URL_ + (URL_.includes('?') ? '&' : '?') + \"input\" + '=' + encodeURIComponent(PAYLOAD)\n  : URL_;\n\ntry {\n  const r = await fetch(reqUrl, { method: METHOD, headers, body, redirect: 'follow' });\n  const text = await r.text();\n  const sig = (text.includes(\"http://127.0.0.1:65533/poc-ssrf-sentinel\") ? 'payload reflected' : '');\n  if (sig) {\n    process.stderr.write('PoC: exploit demonstrated — ' + sig + '\\n');\n    process.exit(0);\n  }\n  process.stderr.write('PoC: payload sent (status ' + r.status + '), no exploit evidence in response\\n');\n  process.exit(1);\n} catch (e) {\n  process.stderr.write('PoC: error reaching target — ' + e.message + '\\n');\n  process.exit(2);\n}\n"
-      },
-      "calibrated_confidence": null,
-      "calibrated_confidence_ci": null,
-      "calibrated_n": 24,
-      "calibration_reason": "insufficient-samples",
-      "verifier_verdict": "verified-sanitizer-absence",
-      "verifier_reason": "no-sanitizer-in-window",
-      "verifier_runner": null,
-      "narration": null,
-      "mitigationVerdict": "unreachable-in-prod",
-      "mitigationsApplied": [],
-      "mitigatedByWaf": false,
-      "wafRuleId": null,
-      "mitigatedByAuth": false,
-      "authMechanism": null,
-      "mitigatedByNetwork": false,
-      "networkExposure": null,
-      "featureFlag": null,
-      "featureFlagState": null,
-      "featureFlagRollout": null,
-      "exposedInProd": false,
-      "unreachableInProd": true,
-      "coldPath": false,
-      "hotPath": false,
-      "prodRequestCount": null,
-      "crownJewelScore": 0,
-      "crownJewelTier": "unknown",
-      "crownJewelFactors": [],
-      "cloneClusterId": null,
-      "cloneClusterSize": 1,
-      "provenance": "mixed",
-      "provenanceScore": 0.3,
-      "typeNarrowed": null,
-      "strideCategory": "tampering",
-      "personaScores": {
-        "script-kiddie": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "opportunistic-criminal": {
-          "score": 0.6,
-          "tier": "high",
-          "factors": [
-            "sev:medium",
-            "bias:ssrf+0.20"
-          ]
-        },
-        "apt-nation-state": {
-          "score": 0.7,
-          "tier": "high",
-          "factors": [
-            "sev:medium",
-            "bias:ssrf+0.30"
-          ]
-        },
-        "supply-chain-attacker": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "malicious-insider": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        }
-      },
-      "personaTopTwo": [
-        "apt-nation-state",
-        "opportunistic-criminal"
-      ],
-      "personaMaxName": "apt-nation-state",
-      "personaMaxScore": 0.7,
-      "reverseExposure": null,
-      "specMined": null,
-      "whyFired": {
-        "detector": "sast/ssrf",
-        "ruleId": "CWE-918",
-        "parser": "SSRF-METADATA",
-        "evidence": {
-          "sinkSnippet": "'CWE-918':  `http://169.254.169.254/latest/meta-data/`,             // SSRF",
-          "sourceSnippet": null,
-          "pathSteps": [],
-          "sanitizers": [],
-          "guards": []
-        },
-        "considered": {
-          "suppressionsApplied": [],
-          "suppressionsSkipped": [],
-          "reachabilityFilter": "unaffected",
-          "clusterCollapsed": false,
-          "typeNarrowed": false,
-          "crownJewelTier": "unknown",
-          "mitigationVerdict": "unreachable-in-prod"
-        },
-        "scanner": {
-          "rulesetVersion": null,
-          "packHash": null,
-          "modelId": null
-        }
-      },
-      "adversaryTranscript": null,
-      "predictedBountyUsd": {
-        "low": 30,
-        "likely": 120,
-        "high": 350,
-        "program": "web2"
-      },
-      "bountyConfidence": "high",
-      "attackPlaybook": null
-    },
-    {
-      "id": "toctou-fs:incremental.js:50",
-      "kind": "sast",
-      "severity": "medium",
-      "vuln": "TOCTOU: file existence/permission check before open",
-      "cwe": "CWE-367",
-      "owaspLlm": null,
-      "stride": "Tampering",
-      "file": "incremental.js",
-      "line": 50,
-      "snippet": "if (!fs.existsSync(versionFp)) return _emptyState();",
-      "fix": null,
-      "reachable": false,
-      "triage": 22,
-      "dataClasses": [],
-      "chain": null,
-      "confidence": 0.7,
-      "toxicity": 8,
-      "toxicityFactors": [],
-      "toxicityLabel": "Low",
-      "sources": null,
-      "epssScore": null,
-      "epssPercentile": null,
-      "epssCve": null,
-      "exploitedNow": false,
-      "tags": null,
-      "blastRadius": {
-        "scope": "all-users",
-        "dataAtRisk": [
-          "config"
-        ],
-        "userCount": 50,
-        "industry": "generic",
-        "jurisdictions": [],
-        "controlsApplied": [],
-        "dollarBest": 23250,
-        "dollarLikely": 136250,
-        "dollarWorst": 775000,
-        "dollarLow": 23250,
-        "dollarHigh": 775000,
-        "components": {
-          "incidentResponse": {
-            "low": 8000,
-            "likely": 50000,
-            "high": 250000
-          },
-          "legal": {
-            "low": 10000,
-            "likely": 75000,
-            "high": 500000
-          },
-          "crisisPR": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "notification": {
-            "low": 5000,
-            "likely": 10000,
-            "high": 15000
-          },
-          "creditMonitoring": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "regulatoryFines": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "directDamage": {
-            "low": 250,
-            "likely": 1250,
-            "high": 10000
-          },
-          "classAction": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "lostBusiness": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          }
-        },
-        "dominantDriver": "legal counsel",
-        "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
-        "confidence": "low",
-        "narrative": "TOCTOU: file existence/permission check before open on `incremental.js:50` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      },
-      "stableId": "3184d498fcca8634",
-      "confidenceTier": "medium",
-      "exploitability": 0.2,
-      "exploitabilityTier": "low",
-      "exploitabilityFactors": [
-        "sev:medium",
-        "unreachable"
-      ],
-      "clusterSize": null,
-      "unreachable": false,
-      "validator_verdict": "unvalidated",
-      "llm_confidence": null,
-      "unvalidated": true,
-      "cross_language": false,
-      "family": "toctou-file-existence-permission-check-b",
-      "_unsigned": false,
-      "_passThroughSigning": false,
-      "signatureStatus": "verified",
-      "regression_test": null,
-      "poc": null,
-      "calibrated_confidence": null,
-      "calibrated_confidence_ci": null,
-      "calibrated_n": 0,
-      "calibration_reason": "no-history",
-      "verifier_verdict": "cannot-verify",
-      "verifier_reason": "no-poc-no-sanitizer-rule",
-      "verifier_runner": null,
-      "narration": null,
-      "mitigationVerdict": "unreachable-in-prod",
-      "mitigationsApplied": [],
-      "mitigatedByWaf": false,
-      "wafRuleId": null,
-      "mitigatedByAuth": false,
-      "authMechanism": null,
-      "mitigatedByNetwork": false,
-      "networkExposure": null,
-      "featureFlag": null,
-      "featureFlagState": null,
-      "featureFlagRollout": null,
-      "exposedInProd": false,
-      "unreachableInProd": true,
-      "coldPath": false,
-      "hotPath": false,
-      "prodRequestCount": null,
-      "crownJewelScore": 0,
-      "crownJewelTier": "unknown",
-      "crownJewelFactors": [],
-      "cloneClusterId": "bf9643a065f64945",
-      "cloneClusterSize": 2,
-      "provenance": "human-likely",
-      "provenanceScore": 0.22,
-      "typeNarrowed": null,
-      "strideCategory": "tampering",
-      "personaScores": {
-        "script-kiddie": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "opportunistic-criminal": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "apt-nation-state": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "supply-chain-attacker": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "malicious-insider": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        }
-      },
-      "personaTopTwo": [
-        "script-kiddie",
-        "opportunistic-criminal"
-      ],
-      "personaMaxName": "script-kiddie",
-      "personaMaxScore": 0.4,
-      "reverseExposure": null,
-      "specMined": null,
-      "whyFired": {
-        "detector": "sast/toctou-file-existence-permission-check-b",
-        "ruleId": "CWE-367",
-        "parser": "TOCTOU",
-        "evidence": {
-          "sinkSnippet": "if (!fs.existsSync(versionFp)) return _emptyState();",
-          "sourceSnippet": null,
-          "pathSteps": [],
-          "sanitizers": [],
-          "guards": []
-        },
-        "considered": {
-          "suppressionsApplied": [],
-          "suppressionsSkipped": [],
-          "reachabilityFilter": "unaffected",
-          "clusterCollapsed": false,
-          "typeNarrowed": false,
-          "crownJewelTier": "unknown",
-          "mitigationVerdict": "unreachable-in-prod"
-        },
-        "scanner": {
-          "rulesetVersion": null,
-          "packHash": null,
-          "modelId": null
-        }
-      },
-      "adversaryTranscript": null,
-      "predictedBountyUsd": null,
-      "bountyConfidence": null,
-      "attackPlaybook": null
-    },
-    {
-      "id": "toctou-fs:incremental.js:68",
-      "kind": "sast",
-      "severity": "medium",
-      "vuln": "TOCTOU: file existence/permission check before open",
-      "cwe": "CWE-367",
-      "owaspLlm": null,
-      "stride": "Tampering",
-      "file": "incremental.js",
-      "line": 68,
-      "snippet": "if (!fs.existsSync(fp)) return fallback;",
-      "fix": null,
-      "reachable": false,
-      "triage": 22,
-      "dataClasses": [],
-      "chain": null,
-      "confidence": 0.7,
-      "toxicity": 8,
-      "toxicityFactors": [],
-      "toxicityLabel": "Low",
-      "sources": null,
-      "epssScore": null,
-      "epssPercentile": null,
-      "epssCve": null,
-      "exploitedNow": false,
-      "tags": null,
-      "blastRadius": {
-        "scope": "all-users",
-        "dataAtRisk": [
-          "config"
-        ],
-        "userCount": 50,
-        "industry": "generic",
-        "jurisdictions": [],
-        "controlsApplied": [],
-        "dollarBest": 23250,
-        "dollarLikely": 136250,
-        "dollarWorst": 775000,
-        "dollarLow": 23250,
-        "dollarHigh": 775000,
-        "components": {
-          "incidentResponse": {
-            "low": 8000,
-            "likely": 50000,
-            "high": 250000
-          },
-          "legal": {
-            "low": 10000,
-            "likely": 75000,
-            "high": 500000
-          },
-          "crisisPR": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "notification": {
-            "low": 5000,
-            "likely": 10000,
-            "high": 15000
-          },
-          "creditMonitoring": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "regulatoryFines": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "directDamage": {
-            "low": 250,
-            "likely": 1250,
-            "high": 10000
-          },
-          "classAction": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "lostBusiness": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          }
-        },
-        "dominantDriver": "legal counsel",
-        "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
-        "confidence": "low",
-        "narrative": "TOCTOU: file existence/permission check before open on `incremental.js:68` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      },
-      "stableId": "ca2e725c38df4ef6",
-      "confidenceTier": "medium",
-      "exploitability": 0.2,
-      "exploitabilityTier": "low",
-      "exploitabilityFactors": [
-        "sev:medium",
-        "unreachable"
-      ],
-      "clusterSize": null,
-      "unreachable": false,
-      "validator_verdict": "unvalidated",
-      "llm_confidence": null,
-      "unvalidated": true,
-      "cross_language": false,
-      "family": "toctou-file-existence-permission-check-b",
-      "_unsigned": false,
-      "_passThroughSigning": false,
-      "signatureStatus": "verified",
-      "regression_test": null,
-      "poc": null,
-      "calibrated_confidence": null,
-      "calibrated_confidence_ci": null,
-      "calibrated_n": 0,
-      "calibration_reason": "no-history",
-      "verifier_verdict": "cannot-verify",
-      "verifier_reason": "no-poc-no-sanitizer-rule",
-      "verifier_runner": null,
-      "narration": null,
-      "mitigationVerdict": "unreachable-in-prod",
-      "mitigationsApplied": [],
-      "mitigatedByWaf": false,
-      "wafRuleId": null,
-      "mitigatedByAuth": false,
-      "authMechanism": null,
-      "mitigatedByNetwork": false,
-      "networkExposure": null,
-      "featureFlag": null,
-      "featureFlagState": null,
-      "featureFlagRollout": null,
-      "exposedInProd": false,
-      "unreachableInProd": true,
-      "coldPath": false,
-      "hotPath": false,
-      "prodRequestCount": null,
-      "crownJewelScore": 0,
-      "crownJewelTier": "unknown",
-      "crownJewelFactors": [],
-      "cloneClusterId": "39f1d6db55cace1d",
-      "cloneClusterSize": 2,
-      "provenance": "human-likely",
-      "provenanceScore": 0.22,
-      "typeNarrowed": null,
-      "strideCategory": "tampering",
-      "personaScores": {
-        "script-kiddie": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "opportunistic-criminal": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "apt-nation-state": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "supply-chain-attacker": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        },
-        "malicious-insider": {
-          "score": 0.4,
-          "tier": "medium",
-          "factors": [
-            "sev:medium"
-          ]
-        }
-      },
-      "personaTopTwo": [
-        "script-kiddie",
-        "opportunistic-criminal"
-      ],
-      "personaMaxName": "script-kiddie",
-      "personaMaxScore": 0.4,
-      "reverseExposure": null,
-      "specMined": null,
-      "whyFired": {
-        "detector": "sast/toctou-file-existence-permission-check-b",
-        "ruleId": "CWE-367",
-        "parser": "TOCTOU",
-        "evidence": {
-          "sinkSnippet": "if (!fs.existsSync(fp)) return fallback;",
-          "sourceSnippet": null,
-          "pathSteps": [],
-          "sanitizers": [],
-          "guards": []
-        },
-        "considered": {
-          "suppressionsApplied": [],
-          "suppressionsSkipped": [],
-          "reachabilityFilter": "unaffected",
-          "clusterCollapsed": false,
-          "typeNarrowed": false,
-          "crownJewelTier": "unknown",
-          "mitigationVerdict": "unreachable-in-prod"
-        },
-        "scanner": {
-          "rulesetVersion": null,
-          "packHash": null,
-          "modelId": null
-        }
-      },
-      "adversaryTranscript": null,
-      "predictedBountyUsd": null,
-      "bountyConfidence": null,
-      "attackPlaybook": null
-    },
-    {
-      "id": "77f1352c8462f8db",
-      "kind": "logic",
-      "severity": "medium",
-      "vuln": "Race Condition (TOCTOU)",
-      "cwe": "CWE-367",
-      "stride": "Tampering",
-      "file": "incremental.js",
-      "line": 223,
-      "snippet": "if (fs.existsSync(fp)) fs.unlinkSync(fp);",
-      "fix": {
-        "description": "Use atomic operations instead of check-then-act patterns.",
-        "code": "// BEFORE\nif (fs.existsSync(p)) fs.unlinkSync(p);\n\n// AFTER\ntry { fs.unlinkSync(p); } catch(e) { if(e.code!=='ENOENT') throw e; }"
-      },
-      "blastRadius": {
-        "scope": "all-users",
-        "dataAtRisk": [
-          "config"
-        ],
-        "userCount": 50,
-        "industry": "generic",
-        "jurisdictions": [],
-        "controlsApplied": [],
-        "dollarBest": 23250,
-        "dollarLikely": 136250,
-        "dollarWorst": 775000,
-        "dollarLow": 23250,
-        "dollarHigh": 775000,
-        "components": {
-          "incidentResponse": {
-            "low": 8000,
-            "likely": 50000,
-            "high": 250000
-          },
-          "legal": {
-            "low": 10000,
-            "likely": 75000,
-            "high": 500000
-          },
-          "crisisPR": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "notification": {
-            "low": 5000,
-            "likely": 10000,
-            "high": 15000
-          },
-          "creditMonitoring": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "regulatoryFines": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "directDamage": {
-            "low": 250,
-            "likely": 1250,
-            "high": 10000
-          },
-          "classAction": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "lostBusiness": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          }
-        },
-        "dominantDriver": "legal counsel",
-        "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
-        "confidence": "low",
-        "narrative": "Race Condition (TOCTOU) on `incremental.js:223` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
-    },
-    {
-      "id": "logic:incremental.js:50:TOCTOU:_existsSync_followed_by_file_op",
-      "kind": "logic",
-      "severity": "medium",
-      "vuln": "TOCTOU: existsSync followed by file op",
-      "cwe": "CWE-367",
-      "stride": "Tampering",
-      "file": "incremental.js",
-      "line": 50,
-      "snippet": "if (!fs.existsSync(versionFp)) return _emptyState();",
-      "fix": {
-        "description": "Replace the check-then-act sequence with a single atomic operation (e.g., `fs.open` with appropriate flags). Between `existsSync` and the file op the file can be replaced by a symlink or removed.",
-        "code": ""
-      },
-      "blastRadius": {
-        "scope": "all-users",
-        "dataAtRisk": [
-          "config"
-        ],
-        "userCount": 50,
-        "industry": "generic",
-        "jurisdictions": [],
-        "controlsApplied": [],
-        "dollarBest": 23250,
-        "dollarLikely": 136250,
-        "dollarWorst": 775000,
-        "dollarLow": 23250,
-        "dollarHigh": 775000,
-        "components": {
-          "incidentResponse": {
-            "low": 8000,
-            "likely": 50000,
-            "high": 250000
-          },
-          "legal": {
-            "low": 10000,
-            "likely": 75000,
-            "high": 500000
-          },
-          "crisisPR": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "notification": {
-            "low": 5000,
-            "likely": 10000,
-            "high": 15000
-          },
-          "creditMonitoring": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "regulatoryFines": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "directDamage": {
-            "low": 250,
-            "likely": 1250,
-            "high": 10000
-          },
-          "classAction": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "lostBusiness": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          }
-        },
-        "dominantDriver": "legal counsel",
-        "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
-        "confidence": "low",
-        "narrative": "TOCTOU: existsSync followed by file op on `incremental.js:50` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
-    },
-    {
-      "id": "logic:incremental.js:68:TOCTOU:_existsSync_followed_by_file_op",
-      "kind": "logic",
-      "severity": "medium",
-      "vuln": "TOCTOU: existsSync followed by file op",
-      "cwe": "CWE-367",
-      "stride": "Tampering",
-      "file": "incremental.js",
-      "line": 68,
-      "snippet": "if (!fs.existsSync(fp)) return fallback;",
-      "fix": {
-        "description": "Replace the check-then-act sequence with a single atomic operation (e.g., `fs.open` with appropriate flags). Between `existsSync` and the file op the file can be replaced by a symlink or removed.",
-        "code": ""
-      },
-      "blastRadius": {
-        "scope": "all-users",
-        "dataAtRisk": [
-          "config"
-        ],
-        "userCount": 50,
-        "industry": "generic",
-        "jurisdictions": [],
-        "controlsApplied": [],
-        "dollarBest": 23250,
-        "dollarLikely": 136250,
-        "dollarWorst": 775000,
-        "dollarLow": 23250,
-        "dollarHigh": 775000,
-        "components": {
-          "incidentResponse": {
-            "low": 8000,
-            "likely": 50000,
-            "high": 250000
-          },
-          "legal": {
-            "low": 10000,
-            "likely": 75000,
-            "high": 500000
-          },
-          "crisisPR": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "notification": {
-            "low": 5000,
-            "likely": 10000,
-            "high": 15000
-          },
-          "creditMonitoring": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "regulatoryFines": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "directDamage": {
-            "low": 250,
-            "likely": 1250,
-            "high": 10000
-          },
-          "classAction": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "lostBusiness": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          }
-        },
-        "dominantDriver": "legal counsel",
-        "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
-        "confidence": "low",
-        "narrative": "TOCTOU: existsSync followed by file op on `incremental.js:68` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
-    },
-    {
-      "id": "logic:incremental.js:223:TOCTOU:_existsSync_followed_by_file_op",
-      "kind": "logic",
-      "severity": "medium",
-      "vuln": "TOCTOU: existsSync followed by file op",
-      "cwe": "CWE-367",
-      "stride": "Tampering",
-      "file": "incremental.js",
-      "line": 223,
-      "snippet": "if (fs.existsSync(fp)) fs.unlinkSync(fp);",
-      "fix": {
-        "description": "Replace the check-then-act sequence with a single atomic operation (e.g., `fs.open` with appropriate flags). Between `existsSync` and the file op the file can be replaced by a symlink or removed.",
-        "code": ""
-      },
-      "blastRadius": {
-        "scope": "all-users",
-        "dataAtRisk": [
-          "config"
-        ],
-        "userCount": 50,
-        "industry": "generic",
-        "jurisdictions": [],
-        "controlsApplied": [],
-        "dollarBest": 23250,
-        "dollarLikely": 136250,
-        "dollarWorst": 775000,
-        "dollarLow": 23250,
-        "dollarHigh": 775000,
-        "components": {
-          "incidentResponse": {
-            "low": 8000,
-            "likely": 50000,
-            "high": 250000
-          },
-          "legal": {
-            "low": 10000,
-            "likely": 75000,
-            "high": 500000
-          },
-          "crisisPR": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "notification": {
-            "low": 5000,
-            "likely": 10000,
-            "high": 15000
-          },
-          "creditMonitoring": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "regulatoryFines": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "directDamage": {
-            "low": 250,
-            "likely": 1250,
-            "high": 10000
-          },
-          "classAction": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          },
-          "lostBusiness": {
-            "low": 0,
-            "likely": 0,
-            "high": 0
-          }
-        },
-        "dominantDriver": "legal counsel",
-        "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
-        "confidence": "low",
-        "narrative": "TOCTOU: existsSync followed by file op on `incremental.js:223` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
-    }
-  ],
-  "bundles": [],
-  "routes": [],
-  "components": [],
-  "suppressedCount": 12,
-  "blastRadiusSignals": {
-    "industry": "generic",
-    "industryConfidence": "low",
-    "jurisdictions": [],
-    "controls": [],
-    "estimatedUsers": 50,
-    "revenueIndicator": "pre-revenue",
-    "hasStripe": false,
-    "hasAuth": false,
-    "hasUserTable": false,
-    "hasPII": false,
-    "hasPHI": false,
-    "hasS3": false
-  },
-  "_v3": {
-    "counterfactual": {
-      "spofControls": [],
-      "controlsDetected": 195
-    },
-    "threatModel": {
-      "summary": {
-        "assetCount": 0,
-        "boundaryCount": 2,
-        "strideCounts": {
-          "spoofing": 0,
-          "tampering": 4,
-          "repudiation": 0,
-          "informationDisclosure": 0,
-          "denialOfService": 9,
-          "elevationOfPrivilege": 0
-        }
-      },
-      "assets": [],
-      "trustBoundaries": [
-        {
-          "type": "db-edge",
-          "file": "catalog.js",
-          "line": 52,
-          "label": null
-        },
-        {
-          "type": "db-edge",
-          "file": "catalog.js",
-          "line": 55,
-          "label": null
-        }
-      ],
-      "stride": {
-        "spoofing": [],
-        "tampering": [
-          {
-            "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
-            "file": "catalog.js",
-            "line": 431,
-            "severity": "medium"
-          },
-          {
-            "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
-            "file": "exploit-prover.js",
-            "line": 33,
-            "severity": "medium"
-          },
-          {
-            "vuln": "TOCTOU: file existence/permission check before open",
-            "file": "incremental.js",
-            "line": 50,
-            "severity": "medium"
-          },
-          {
-            "vuln": "TOCTOU: file existence/permission check before open",
-            "file": "incremental.js",
-            "line": 68,
-            "severity": "medium"
-          }
-        ],
-        "repudiation": [],
-        "informationDisclosure": [],
-        "denialOfService": [
-          {
-            "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
-            "file": "incremental.js",
-            "severity": "medium"
-          },
-          {
-            "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
-            "file": "incremental.js",
-            "severity": "medium"
-          },
-          {
-            "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
-            "file": "incremental.js",
-            "severity": "medium"
-          },
-          {
-            "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
-            "file": "incremental.js",
-            "severity": "medium"
-          },
-          {
-            "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
-            "file": "incremental.js",
-            "severity": "medium"
-          },
-          {
-            "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
-            "file": "incremental.js",
-            "severity": "medium"
-          },
-          {
-            "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
-            "file": "incremental.js",
-            "severity": "medium"
-          },
-          {
-            "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
-            "file": "incremental.js",
-            "severity": "medium"
-          },
-          {
-            "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
-            "file": "incremental.js",
-            "severity": "medium"
-          }
-        ],
-        "elevationOfPrivilege": []
-      }
-    },
-    "trustBoundaryDiagram": {
-      "mermaid": "flowchart LR\n  INTERNET((Internet))\n  APP[\"Application\"]\n  db_catalog_js_52[(\"db@catalog.js:52\")]\n  db_catalog_js_55[(\"db@catalog.js:55\")]\n  APP -->|db| db_catalog_js_52\n  APP -->|db| db_catalog_js_55\n  classDef sev_critical fill:#ffcccc,stroke:#a00,stroke-width:2px;\n  classDef sev_high fill:#ffe0b2,stroke:#c60,stroke-width:2px;\n  classDef sev_medium fill:#fff3cd,stroke:#a80;\n  classDef sev_low fill:#e8eaf6,stroke:#557;",
-      "nodes": [
-        {
-          "id": "INTERNET",
-          "kind": "external",
-          "label": "Internet"
-        },
-        {
-          "id": "APP",
-          "kind": "app",
-          "label": "Application"
-        },
-        {
-          "kind": "db",
-          "id": "db_catalog_js_52",
-          "label": "db@catalog.js:52"
-        },
-        {
-          "kind": "db",
-          "id": "db_catalog_js_55",
-          "label": "db@catalog.js:55"
-        }
-      ],
-      "edges": [
-        {
-          "from": "APP",
-          "to": "db_catalog_js_52",
-          "kind": "db"
-        },
-        {
-          "from": "APP",
-          "to": "db_catalog_js_55",
-          "kind": "db"
-        }
-      ],
-      "decorations": []
-    },
-    "calibrationDrift": {
-      "alarms": [],
-      "note": "no-feedback-data"
-    }
-  }
-}