@clear-capabilities/agentic-security-scanner 0.76.1 → 0.78.0

package/src/posture/.agentic-security/findings.json

@@ -1,7 +1,7 @@
 {
-  "scanId": "f293f70c-5c2c-4047-8616-a06df84df107",
-  "startedAt": "2026-05-20T15:34:19.073Z",
-  "durationMs": 1144,
+  "scanId": "997198bb-2db8-40c6-93c5-53c52cd42d9b",
+  "startedAt": "2026-05-27T11:19:52.727Z",
+  "durationMs": 1095,
   "scanned": {
     "files": 98,
     "lines": 0
@@ -86,7 +86,9 @@
         "comparable": "AWS keys leaked: avg $200k crypto-mining bill in <48h; OpenAI keys: $30–100k overnight",
         "confidence": "low",
         "narrative": "Hardcoded Secret on `attack-playbooks.js:91` could expose production credentials and API keys. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $24k · likely $138k · worst $778k. Dominant driver: legal counsel. Comparable: AWS keys leaked: avg $200k crypto-mining bill in <48h; OpenAI keys: $30–100k overnight."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "f813e80ea9dc10f8",
@@ -167,7 +169,9 @@
         "comparable": "AWS keys leaked: avg $200k crypto-mining bill in <48h; OpenAI keys: $30–100k overnight",
         "confidence": "low",
         "narrative": "Hardcoded Secret on `mitigation-composite.js:27` could expose production credentials and API keys. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $24k · likely $138k · worst $778k. Dominant driver: legal counsel. Comparable: AWS keys leaked: avg $200k crypto-mining bill in <48h; OpenAI keys: $30–100k overnight."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "struct:deploy-platform.js:13:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
@@ -280,6 +284,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -513,6 +518,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -739,6 +745,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "state-machine-bypass",
+      "parser": "STATE-MACHINE",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -918,6 +925,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "state-machine-bypass",
+      "parser": "STATE-MACHINE",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -1097,6 +1105,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "state-machine-bypass",
+      "parser": "STATE-MACHINE",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -1276,6 +1285,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "state-machine-bypass",
+      "parser": "STATE-MACHINE",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -1455,6 +1465,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "state-machine-bypass",
+      "parser": "STATE-MACHINE",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -1634,6 +1645,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "state-machine-bypass",
+      "parser": "STATE-MACHINE",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -1813,6 +1825,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "state-machine-bypass",
+      "parser": "STATE-MACHINE",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -1992,6 +2005,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "state-machine-bypass",
+      "parser": "STATE-MACHINE",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -2171,6 +2185,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "state-machine-bypass",
+      "parser": "STATE-MACHINE",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -2325,7 +2340,9 @@
         "comparable": "Air Canada 2024 LLM chatbot DoS → court-ordered refunds + reputational damage",
         "confidence": "low",
         "narrative": "Missing Timeout on Outbound HTTP Request (DoS) on `adversary-agent.js:117` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Air Canada 2024 LLM chatbot DoS → court-ordered refunds + reputational damage."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "3d7f5144e9ce1781",
@@ -2406,7 +2423,9 @@
         "comparable": "Air Canada 2024 LLM chatbot DoS → court-ordered refunds + reputational damage",
         "confidence": "low",
         "narrative": "Missing Timeout on Outbound HTTP Request (DoS) on `adversary-agent.js:146` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Air Canada 2024 LLM chatbot DoS → court-ordered refunds + reputational damage."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "7d793329125fa392",
@@ -2487,7 +2506,9 @@
         "comparable": "Air Canada 2024 LLM chatbot DoS → court-ordered refunds + reputational damage",
         "confidence": "low",
         "narrative": "Missing Timeout on Outbound HTTP Request (DoS) on `adversary-agent.js:154` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Air Canada 2024 LLM chatbot DoS → court-ordered refunds + reputational damage."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:agents-memory.js:44:TOCTOU:_existsSync_followed_by_file_op",
@@ -2568,7 +2589,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `agents-memory.js:44` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:agents-memory.js:69:TOCTOU:_existsSync_followed_by_file_op",
@@ -2649,7 +2672,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `agents-memory.js:69` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:agents-memory.js:107:TOCTOU:_existsSync_followed_by_file_op",
@@ -2730,7 +2755,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `agents-memory.js:107` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:auth-posture-import.js:53:TOCTOU:_existsSync_followed_by_file_op",
@@ -2811,7 +2838,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `auth-posture-import.js:53` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:calibration-drift.js:39:TOCTOU:_existsSync_followed_by_file_op",
@@ -2892,7 +2921,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `calibration-drift.js:39` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:cve-alert-daemon.js:271:TOCTOU:_existsSync_followed_by_file_op",
@@ -2973,7 +3004,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `cve-alert-daemon.js:271` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:cve-alert-daemon.js:289:TOCTOU:_existsSync_followed_by_file_op",
@@ -3054,7 +3087,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `cve-alert-daemon.js:289` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "98b34a187b2233f4",
@@ -3135,7 +3170,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "Known-Broken Code Marker Near Security-Sensitive Logic on `cve-lookup.js:64` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:cve-lookup.js:32:TOCTOU:_existsSync_followed_by_file_op",
@@ -3216,7 +3253,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `cve-lookup.js:32` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:deterministic.js:53:TOCTOU:_existsSync_followed_by_file_op",
@@ -3297,7 +3336,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `deterministic.js:53` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "6f8230ef374727c1",
@@ -3378,7 +3419,9 @@
         "comparable": "Air Canada 2024 LLM chatbot DoS → court-ordered refunds + reputational damage",
         "confidence": "low",
         "narrative": "Missing Timeout on Outbound HTTP Request (DoS) on `epss.js:73` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Air Canada 2024 LLM chatbot DoS → court-ordered refunds + reputational damage."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:epss.js:34:TOCTOU:_existsSync_followed_by_file_op",
@@ -3459,7 +3502,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `epss.js:34` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:exploitability-probability.js:142:TOCTOU:_existsSync_followed_by_file_op",
@@ -3540,7 +3585,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `exploitability-probability.js:142` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:feature-flags.js:53:TOCTOU:_existsSync_followed_by_file_op",
@@ -3621,7 +3668,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `feature-flags.js:53` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:fix-history.js:25:TOCTOU:_existsSync_followed_by_file_op",
@@ -3702,7 +3751,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `fix-history.js:25` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:fix-history.js:42:TOCTOU:_existsSync_followed_by_file_op",
@@ -3783,7 +3834,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `fix-history.js:42` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "4d1f25f2f49d3c36",
@@ -3864,7 +3917,9 @@
         "comparable": "Air Canada 2024 LLM chatbot DoS → court-ordered refunds + reputational damage",
         "confidence": "low",
         "narrative": "Missing Timeout on Outbound HTTP Request (DoS) on `flow-narration.js:73` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Air Canada 2024 LLM chatbot DoS → court-ordered refunds + reputational damage."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:grader-calibration.js:34:TOCTOU:_existsSync_followed_by_file_op",
@@ -3945,7 +4000,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `grader-calibration.js:34` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:grader-calibration.js:41:TOCTOU:_existsSync_followed_by_file_op",
@@ -4026,7 +4083,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `grader-calibration.js:41` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:holdout-eval.js:53:TOCTOU:_existsSync_followed_by_file_op",
@@ -4107,7 +4166,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `holdout-eval.js:53` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:integrity.js:43:TOCTOU:_existsSync_followed_by_file_op",
@@ -4188,7 +4249,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `integrity.js:43` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:integrity.js:77:TOCTOU:_existsSync_followed_by_file_op",
@@ -4269,7 +4332,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `integrity.js:77` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:learning.js:30:TOCTOU:_existsSync_followed_by_file_op",
@@ -4350,7 +4415,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `learning.js:30` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:license-policy.js:30:TOCTOU:_existsSync_followed_by_file_op",
@@ -4431,7 +4498,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `license-policy.js:30` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "068537d2082ff5e9",
@@ -4512,7 +4581,9 @@
         "comparable": "Air Canada 2024 LLM chatbot DoS → court-ordered refunds + reputational damage",
         "confidence": "low",
         "narrative": "Missing Timeout on Outbound HTTP Request (DoS) on `llm-redteam.js:145` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Air Canada 2024 LLM chatbot DoS → court-ordered refunds + reputational damage."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:network-policy-import.js:85:TOCTOU:_existsSync_followed_by_file_op",
@@ -4593,7 +4664,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `network-policy-import.js:85` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "cdf48e92135085d0",
@@ -4674,7 +4747,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "Weak Randomness on `poc-generator.js:67` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "afe969d251c2bd7c",
@@ -4755,7 +4830,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "Weak Randomness on `poc-generator.js:257` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:policy-gate.js:154:TOCTOU:_existsSync_followed_by_file_op",
@@ -4836,7 +4913,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `policy-gate.js:154` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:profile.js:45:TOCTOU:_existsSync_followed_by_file_op",
@@ -4917,7 +4996,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `profile.js:45` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:router.js:21:TOCTOU:_existsSync_followed_by_file_op",
@@ -4998,7 +5079,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `router.js:21` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:rule-overrides.js:23:TOCTOU:_existsSync_followed_by_file_op",
@@ -5079,7 +5162,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `rule-overrides.js:23` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:rule-overrides.js:73:TOCTOU:_existsSync_followed_by_file_op",
@@ -5160,7 +5245,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `rule-overrides.js:73` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "294af777c35ee12d",
@@ -5241,7 +5328,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "Timing Oracle — Non-Constant-Time Secret Comparison on `rule-pack-signing.js:72` could expose production credentials and API keys. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $24k · likely $138k · worst $778k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "7cafc7b67b2d3edb",
@@ -5322,7 +5411,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "Timing Oracle — Non-Constant-Time Secret Comparison on `rule-pack-signing.js:132` could expose production credentials and API keys. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $24k · likely $138k · worst $778k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:rule-pack-signing.js:67:TOCTOU:_existsSync_followed_by_file_op",
@@ -5403,7 +5494,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `rule-pack-signing.js:67` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:rule-synthesis.js:24:TOCTOU:_existsSync_followed_by_file_op",
@@ -5484,7 +5577,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `rule-synthesis.js:24` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:ruleset-version.js:36:TOCTOU:_existsSync_followed_by_file_op",
@@ -5565,7 +5660,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `ruleset-version.js:36` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:suppressions.js:26:TOCTOU:_existsSync_followed_by_file_op",
@@ -5646,7 +5743,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `suppressions.js:26` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:suppressions.js:57:TOCTOU:_existsSync_followed_by_file_op",
@@ -5727,7 +5826,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `suppressions.js:57` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:telemetry-ingest.js:41:TOCTOU:_existsSync_followed_by_file_op",
@@ -5808,7 +5909,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `telemetry-ingest.js:41` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:triage.js:18:TOCTOU:_existsSync_followed_by_file_op",
@@ -5889,7 +5992,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `triage.js:18` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:validator-metrics.js:35:TOCTOU:_existsSync_followed_by_file_op",
@@ -5970,7 +6075,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `validator-metrics.js:35` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:verifier-target.js:66:TOCTOU:_existsSync_followed_by_file_op",
@@ -6051,7 +6158,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `verifier-target.js:66` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:version.js:43:TOCTOU:_existsSync_followed_by_file_op",
@@ -6132,7 +6241,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `version.js:43` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "0f41f0071a156a78",
@@ -6213,7 +6324,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "Weak Randomness on `waf-ingest.js:85` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "7e68ef46e5a43e74",
@@ -6294,7 +6407,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "Weak Randomness on `waf-ingest.js:95` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:waf-ingest.js:138:TOCTOU:_existsSync_followed_by_file_op",
@@ -6375,7 +6490,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "TOCTOU: existsSync followed by file op on `waf-ingest.js:138` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "ssrf-meta-hardcoded:attack-playbooks.js:72",
@@ -6487,15 +6604,16 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "ssrf",
+      "parser": "SSRF-METADATA",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
       "regression_test": {
         "lang": "node",
-        "framework": "jest",
-        "filename": "security_80d409f9041d48c2.test.mjs",
-        "runHint": "npx jest",
-        "code": "// Regression test for SSRF: explicit reference to cloud instance-metadata endpoint (CWE-918).\n// Auto-generated from P1.1 PoC; fails on vulnerable code, passes after the fix.\n\nimport { test, expect } from '@jest/globals';\n\ntest('SSRF: explicit reference to cloud instance-metadata endpoint', async () => {\n  const URL_ = \"http://localhost:3000/api/users/2\";\n  const METHOD = \"GET\";\n  const PAYLOAD = \"http://127.0.0.1:65533/poc-ssrf-sentinel\";\n  const body = METHOD === 'GET' ? null : JSON.stringify({ input: PAYLOAD });\n  const reqUrl = METHOD === 'GET'\n    ? URL_ + (URL_.includes('?') ? '&' : '?') + 'input=' + encodeURIComponent(PAYLOAD)\n    : URL_;\n  const r = await fetch(reqUrl, { method: METHOD, headers: { 'Content-Type': 'application/json' }, body });\n  const text = await r.text();\n  // The assertion below is the \"exploit demonstrated\" signal — when this\n  // test PASSES, the vuln is still present. After the fix, this assertion\n  // SHOULD fail. Inverse the assertion in a green build.\n  const demonstrated = text.includes('PoC') || /syntax error/i.test(text) || text.includes('<script>');\n  expect(demonstrated).toBe(false);\n});\n"
+        "framework": null,
+        "filename": null,
+        "runHint": null,
+        "code": null
       },
       "poc": {
         "lang": "node",
@@ -6503,7 +6621,10 @@
         "cwe": "CWE-918",
         "family": "ssrf",
         "runHint": "node poc.mjs",
-        "code": "// Demonstrates SSRF by forcing the server to fetch a localhost sentinel URL.\n// Endpoint:   GET http://localhost:3000/api/users/2\n// Payload:    http://127.0.0.1:65533/poc-ssrf-sentinel\n// Expect:     sentinel server logs a request from the target — proves the target made an outbound call we controlled\n// Run:        node poc.mjs\n// Exit code:  0 = exploit demonstrated, 1 = not demonstrated, 2 = error\n\nconst URL_ = \"http://localhost:3000/api/users/2\";\nconst METHOD = \"GET\";\nconst PAYLOAD = `http://127.0.0.1:65533/poc-ssrf-sentinel`;\n\nconst body = METHOD === 'GET'\n  ? null\n  : JSON.stringify({ \"input\": PAYLOAD });\n\nconst headers = { 'Content-Type': 'application/json' };\n\nconst reqUrl = METHOD === 'GET'\n  ? URL_ + (URL_.includes('?') ? '&' : '?') + \"input\" + '=' + encodeURIComponent(PAYLOAD)\n  : URL_;\n\ntry {\n  const r = await fetch(reqUrl, { method: METHOD, headers, body, redirect: 'follow' });\n  const text = await r.text();\n  const sig = (text.includes(\"http://127.0.0.1:65533/poc-ssrf-sentinel\") ? 'payload reflected' : '');\n  if (sig) {\n    process.stderr.write('PoC: exploit demonstrated — ' + sig + '\\n');\n    process.exit(0);\n  }\n  process.stderr.write('PoC: payload sent (status ' + r.status + '), no exploit evidence in response\\n');\n  process.exit(1);\n} catch (e) {\n  process.stderr.write('PoC: error reaching target — ' + e.message + '\\n');\n  process.exit(2);\n}\n"
+        "code": "// Demonstrates SSRF by forcing the server to fetch a localhost sentinel URL.\n// Endpoint:   GET http://localhost:3000/api/users/2\n// Payload:    http://127.0.0.1:65533/poc-ssrf-sentinel\n// Expect:     sentinel server logs a request from the target — proves the target made an outbound call we controlled\n// Run:        node poc.mjs\n// Exit code:  0 = exploit demonstrated, 1 = not demonstrated, 2 = error\n\nconst URL_ = \"http://localhost:3000/api/users/2\";\nconst METHOD = \"GET\";\nconst PAYLOAD = `http://127.0.0.1:65533/poc-ssrf-sentinel`;\n\nconst body = METHOD === 'GET'\n  ? null\n  : JSON.stringify({ \"input\": PAYLOAD });\n\nconst headers = { 'Content-Type': 'application/json' };\n\nconst reqUrl = METHOD === 'GET'\n  ? URL_ + (URL_.includes('?') ? '&' : '?') + \"input\" + '=' + encodeURIComponent(PAYLOAD)\n  : URL_;\n\ntry {\n  const r = await fetch(reqUrl, { method: METHOD, headers, body, redirect: 'follow' });\n  const text = await r.text();\n  const sig = (text.includes(\"http://127.0.0.1:65533/poc-ssrf-sentinel\") ? 'payload reflected' : '');\n  if (sig) {\n    process.stderr.write('PoC: exploit demonstrated — ' + sig + '\\n');\n    process.exit(0);\n  }\n  process.stderr.write('PoC: payload sent (status ' + r.status + '), no exploit evidence in response\\n');\n  process.exit(1);\n} catch (e) {\n  process.stderr.write('PoC: error reaching target — ' + e.message + '\\n');\n  process.exit(2);\n}\n",
+        "paramKey": "input",
+        "paramKeyConfidence": "low",
+        "paramKeyInferred": false
       },
       "calibrated_confidence": null,
       "calibrated_confidence_ci": null,
@@ -6733,6 +6854,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "mass-assignment",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -6967,6 +7089,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "mass-assignment",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -7201,6 +7324,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -7430,6 +7554,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -7659,6 +7784,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -7888,6 +8014,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -8117,6 +8244,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -8346,6 +8474,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -8575,6 +8704,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -8804,6 +8934,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -9033,6 +9164,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -9262,6 +9394,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -9493,6 +9626,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -9724,6 +9858,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -9957,6 +10092,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -10190,6 +10326,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -10423,6 +10560,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -10656,6 +10794,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -10889,6 +11028,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -11122,6 +11262,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -11355,6 +11496,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -11588,6 +11730,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -11821,6 +11964,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -12054,6 +12198,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -12283,6 +12428,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -12512,6 +12658,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -12547,7 +12694,7 @@
       "cloneClusterId": "29d998f79544cba7",
       "cloneClusterSize": 7,
       "provenance": "mixed",
-      "provenanceScore": 0.3,
+      "provenanceScore": 0.34,
       "typeNarrowed": null,
       "strideCategory": "denialOfService",
       "personaScores": {
@@ -12741,6 +12888,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -12776,7 +12924,7 @@
       "cloneClusterId": "cc47a2e427e15347",
       "cloneClusterSize": 2,
       "provenance": "mixed",
-      "provenanceScore": 0.3,
+      "provenanceScore": 0.34,
       "typeNarrowed": null,
       "strideCategory": "denialOfService",
       "personaScores": {
@@ -12970,6 +13118,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -13201,6 +13350,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -13432,6 +13582,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -13663,6 +13814,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -13894,6 +14046,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -14125,6 +14278,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -14356,6 +14510,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -14587,6 +14742,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -14818,6 +14974,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -15049,6 +15206,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -15280,6 +15438,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -15511,6 +15670,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -15740,6 +15900,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -15969,6 +16130,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -16198,6 +16360,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -16427,6 +16590,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -16656,6 +16820,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -16885,6 +17050,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -17114,6 +17280,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -17343,6 +17510,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -17572,6 +17740,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -17801,6 +17970,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -18030,6 +18200,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -18259,6 +18430,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -18490,6 +18662,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -18721,6 +18894,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -18950,6 +19124,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -19179,6 +19354,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -19408,6 +19584,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -19637,6 +19814,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -19866,6 +20044,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -20095,6 +20274,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -20324,6 +20504,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -20555,6 +20736,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -20786,6 +20968,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -21015,6 +21198,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -21244,6 +21428,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -21473,6 +21658,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -21702,6 +21888,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -21931,6 +22118,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -22162,6 +22350,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -22393,6 +22582,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -22624,6 +22814,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -22855,6 +23046,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -23086,6 +23278,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -23315,6 +23508,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -23544,6 +23738,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -23773,6 +23968,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -24002,6 +24198,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -24231,6 +24428,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -24462,6 +24660,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -24693,6 +24892,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -24924,6 +25124,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -25155,6 +25356,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -25386,6 +25588,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -25617,6 +25820,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -25848,6 +26052,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -26079,6 +26284,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -26310,6 +26516,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -26539,6 +26746,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -26768,6 +26976,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -26997,6 +27206,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -27226,6 +27436,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -27455,6 +27666,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -27684,6 +27896,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -27913,6 +28126,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -28142,6 +28356,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -28371,6 +28586,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -28602,6 +28818,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -28833,6 +29050,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -29064,6 +29282,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -29295,6 +29514,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -29526,6 +29746,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -29757,6 +29978,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -29988,6 +30210,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -30219,6 +30442,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -30450,6 +30674,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -30681,6 +30906,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -30912,6 +31138,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -31143,6 +31370,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -31374,6 +31602,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -31603,6 +31832,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -31832,6 +32062,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -32061,6 +32292,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -32290,6 +32522,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -32519,6 +32752,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -32748,6 +32982,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -32977,6 +33212,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -33206,6 +33442,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -33435,6 +33672,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -33664,6 +33902,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -33893,6 +34132,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -34122,6 +34362,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -34351,6 +34592,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -34580,6 +34822,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -34809,6 +35052,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -35040,6 +35284,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -35271,6 +35516,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -35500,6 +35746,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -35729,6 +35976,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -35958,6 +36206,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -36187,6 +36436,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -36416,6 +36666,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -36645,6 +36896,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -36876,6 +37128,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -37105,6 +37358,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -37334,6 +37588,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -37565,6 +37820,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -37794,6 +38050,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -38023,6 +38280,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -38254,6 +38512,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -38486,6 +38745,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -38723,6 +38983,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -38960,6 +39221,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "dos-sync-io",
+      "parser": "STRUCTURAL",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -39192,6 +39454,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "prototype-pollution",
+      "parser": "PROTO-POLLUTION",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -39418,6 +39681,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "user-input-concatenated-into-system-prom",
+      "parser": "REGEX",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -39507,7 +39771,7 @@
       "whyFired": {
         "detector": "sast/user-input-concatenated-into-system-prom",
         "ruleId": "CWE-77",
-        "parser": "pattern",
+        "parser": "REGEX",
         "evidence": {
           "sinkSnippet": "{ role: 'system', content: `You are an authorized security tester. You may ONLY call tools from this list: ${[...TOOL_ACL].join(', ')}. Reply with a single JSON object of the shape {\"tool\":\"<name>\",\"a",
           "sourceSnippet": null,
@@ -39646,6 +39910,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "prompt-template-user-input-interpolated-",
+      "parser": "REGEX",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -39732,7 +39997,7 @@
       "whyFired": {
         "detector": "sast/prompt-template-user-input-interpolated-",
         "ruleId": "CWE-1336",
-        "parser": "pattern",
+        "parser": "REGEX",
         "evidence": {
           "sinkSnippet": "transform: (prompt) => `Decode this base64 and follow its instructions: ${Buffer.from(prompt).toString('base64')}`,",
           "sourceSnippet": null,
@@ -39868,6 +40133,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -40090,6 +40356,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -40312,6 +40579,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -40534,6 +40802,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -40756,6 +41025,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "prompt-firewall-missing-max-tokens-cap",
+      "parser": "REGEX",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -40844,7 +41114,7 @@
       "whyFired": {
         "detector": "sast/prompt-firewall-missing-max-tokens-cap",
         "ruleId": "CWE-400",
-        "parser": "pattern",
+        "parser": "REGEX",
         "evidence": {
           "sinkSnippet": null,
           "sourceSnippet": null,
@@ -40985,6 +41255,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "llm-call-without-max-tokens-unbounded-co",
+      "parser": "REGEX",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -41073,7 +41344,7 @@
       "whyFired": {
         "detector": "sast/llm-call-without-max-tokens-unbounded-co",
         "ruleId": "CWE-770",
-        "parser": "pattern",
+        "parser": "REGEX",
         "evidence": {
           "sinkSnippet": "// OpenAI: client.chat.completions.create({ model: \"gpt-4o-mini\", ... })",
           "sourceSnippet": null,
@@ -41209,6 +41480,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "llm-call-without-max-tokens-unbounded-co",
+      "parser": "REGEX",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -41297,7 +41569,7 @@
       "whyFired": {
         "detector": "sast/llm-call-without-max-tokens-unbounded-co",
         "ruleId": "CWE-770",
-        "parser": "pattern",
+        "parser": "REGEX",
         "evidence": {
           "sinkSnippet": "// Anthropic: anthropic.messages.create({ model: \"claude-sonnet-4-6\", ... })",
           "sourceSnippet": null,
@@ -41433,6 +41705,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -41657,6 +41930,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -41879,6 +42153,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -42103,6 +42378,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -42327,6 +42603,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -42549,15 +42826,16 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "ssrf",
+      "parser": "SSRF-METADATA",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
       "regression_test": {
         "lang": "node",
-        "framework": "jest",
-        "filename": "security_56f94fc76b59bd2b.test.mjs",
-        "runHint": "npx jest",
-        "code": "// Regression test for SSRF: explicit reference to cloud instance-metadata endpoint (CWE-918).\n// Auto-generated from P1.1 PoC; fails on vulnerable code, passes after the fix.\n\nimport { test, expect } from '@jest/globals';\n\ntest('SSRF: explicit reference to cloud instance-metadata endpoint', async () => {\n  const URL_ = \"http://localhost:3000/REPLACE-WITH-ENDPOINT\";\n  const METHOD = \"POST\";\n  const PAYLOAD = \"http://127.0.0.1:65533/poc-ssrf-sentinel\";\n  const body = METHOD === 'GET' ? null : JSON.stringify({ input: PAYLOAD });\n  const reqUrl = METHOD === 'GET'\n    ? URL_ + (URL_.includes('?') ? '&' : '?') + 'input=' + encodeURIComponent(PAYLOAD)\n    : URL_;\n  const r = await fetch(reqUrl, { method: METHOD, headers: { 'Content-Type': 'application/json' }, body });\n  const text = await r.text();\n  // The assertion below is the \"exploit demonstrated\" signal — when this\n  // test PASSES, the vuln is still present. After the fix, this assertion\n  // SHOULD fail. Inverse the assertion in a green build.\n  const demonstrated = text.includes('PoC') || /syntax error/i.test(text) || text.includes('<script>');\n  expect(demonstrated).toBe(false);\n});\n"
+        "framework": null,
+        "filename": null,
+        "runHint": null,
+        "code": null
       },
       "poc": {
         "lang": "node",
@@ -42565,7 +42843,10 @@
         "cwe": "CWE-918",
         "family": "ssrf",
         "runHint": "node poc.mjs",
-        "code": "// Demonstrates SSRF by forcing the server to fetch a localhost sentinel URL.\n// Endpoint:   POST http://localhost:3000/REPLACE-WITH-ENDPOINT\n// Payload:    http://127.0.0.1:65533/poc-ssrf-sentinel\n// Expect:     sentinel server logs a request from the target — proves the target made an outbound call we controlled\n// Run:        node poc.mjs\n// Exit code:  0 = exploit demonstrated, 1 = not demonstrated, 2 = error\n\nconst URL_ = \"http://localhost:3000/REPLACE-WITH-ENDPOINT\";\nconst METHOD = \"POST\";\nconst PAYLOAD = `http://127.0.0.1:65533/poc-ssrf-sentinel`;\n\nconst body = METHOD === 'GET'\n  ? null\n  : JSON.stringify({ \"input\": PAYLOAD });\n\nconst headers = { 'Content-Type': 'application/json' };\n\nconst reqUrl = METHOD === 'GET'\n  ? URL_ + (URL_.includes('?') ? '&' : '?') + \"input\" + '=' + encodeURIComponent(PAYLOAD)\n  : URL_;\n\ntry {\n  const r = await fetch(reqUrl, { method: METHOD, headers, body, redirect: 'follow' });\n  const text = await r.text();\n  const sig = (text.includes(\"http://127.0.0.1:65533/poc-ssrf-sentinel\") ? 'payload reflected' : '');\n  if (sig) {\n    process.stderr.write('PoC: exploit demonstrated — ' + sig + '\\n');\n    process.exit(0);\n  }\n  process.stderr.write('PoC: payload sent (status ' + r.status + '), no exploit evidence in response\\n');\n  process.exit(1);\n} catch (e) {\n  process.stderr.write('PoC: error reaching target — ' + e.message + '\\n');\n  process.exit(2);\n}\n"
+        "code": "// Demonstrates SSRF by forcing the server to fetch a localhost sentinel URL.\n// Endpoint:   POST http://localhost:3000/REPLACE-WITH-ENDPOINT\n// Payload:    http://127.0.0.1:65533/poc-ssrf-sentinel\n// Expect:     sentinel server logs a request from the target — proves the target made an outbound call we controlled\n// Run:        node poc.mjs\n// Exit code:  0 = exploit demonstrated, 1 = not demonstrated, 2 = error\n\nconst URL_ = \"http://localhost:3000/REPLACE-WITH-ENDPOINT\";\nconst METHOD = \"POST\";\nconst PAYLOAD = `http://127.0.0.1:65533/poc-ssrf-sentinel`;\n\nconst body = METHOD === 'GET'\n  ? null\n  : JSON.stringify({ \"input\": PAYLOAD });\n\nconst headers = { 'Content-Type': 'application/json' };\n\nconst reqUrl = METHOD === 'GET'\n  ? URL_ + (URL_.includes('?') ? '&' : '?') + \"input\" + '=' + encodeURIComponent(PAYLOAD)\n  : URL_;\n\ntry {\n  const r = await fetch(reqUrl, { method: METHOD, headers, body, redirect: 'follow' });\n  const text = await r.text();\n  const sig = (text.includes(\"http://127.0.0.1:65533/poc-ssrf-sentinel\") ? 'payload reflected' : '');\n  if (sig) {\n    process.stderr.write('PoC: exploit demonstrated — ' + sig + '\\n');\n    process.exit(0);\n  }\n  process.stderr.write('PoC: payload sent (status ' + r.status + '), no exploit evidence in response\\n');\n  process.exit(1);\n} catch (e) {\n  process.stderr.write('PoC: error reaching target — ' + e.message + '\\n');\n  process.exit(2);\n}\n",
+        "paramKey": null,
+        "paramKeyConfidence": "low",
+        "paramKeyInferred": false
       },
       "calibrated_confidence": null,
       "calibrated_confidence_ci": null,
@@ -42794,6 +43075,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -43016,6 +43298,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -43238,6 +43521,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -43460,6 +43744,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -43684,6 +43969,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -43906,6 +44192,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -44128,6 +44415,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -44352,15 +44640,16 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "ssrf",
+      "parser": "SSRF-METADATA",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
       "regression_test": {
         "lang": "node",
-        "framework": "jest",
-        "filename": "security_6a315fddf4a2fb12.test.mjs",
-        "runHint": "npx jest",
-        "code": "// Regression test for SSRF: explicit reference to cloud instance-metadata endpoint (CWE-918).\n// Auto-generated from P1.1 PoC; fails on vulnerable code, passes after the fix.\n\nimport { test, expect } from '@jest/globals';\n\ntest('SSRF: explicit reference to cloud instance-metadata endpoint', async () => {\n  const URL_ = \"http://localhost:3000/REPLACE-WITH-ENDPOINT\";\n  const METHOD = \"POST\";\n  const PAYLOAD = \"http://127.0.0.1:65533/poc-ssrf-sentinel\";\n  const body = METHOD === 'GET' ? null : JSON.stringify({ input: PAYLOAD });\n  const reqUrl = METHOD === 'GET'\n    ? URL_ + (URL_.includes('?') ? '&' : '?') + 'input=' + encodeURIComponent(PAYLOAD)\n    : URL_;\n  const r = await fetch(reqUrl, { method: METHOD, headers: { 'Content-Type': 'application/json' }, body });\n  const text = await r.text();\n  // The assertion below is the \"exploit demonstrated\" signal — when this\n  // test PASSES, the vuln is still present. After the fix, this assertion\n  // SHOULD fail. Inverse the assertion in a green build.\n  const demonstrated = text.includes('PoC') || /syntax error/i.test(text) || text.includes('<script>');\n  expect(demonstrated).toBe(false);\n});\n"
+        "framework": null,
+        "filename": null,
+        "runHint": null,
+        "code": null
       },
       "poc": {
         "lang": "node",
@@ -44368,7 +44657,10 @@
         "cwe": "CWE-918",
         "family": "ssrf",
         "runHint": "node poc.mjs",
-        "code": "// Demonstrates SSRF by forcing the server to fetch a localhost sentinel URL.\n// Endpoint:   POST http://localhost:3000/REPLACE-WITH-ENDPOINT\n// Payload:    http://127.0.0.1:65533/poc-ssrf-sentinel\n// Expect:     sentinel server logs a request from the target — proves the target made an outbound call we controlled\n// Run:        node poc.mjs\n// Exit code:  0 = exploit demonstrated, 1 = not demonstrated, 2 = error\n\nconst URL_ = \"http://localhost:3000/REPLACE-WITH-ENDPOINT\";\nconst METHOD = \"POST\";\nconst PAYLOAD = `http://127.0.0.1:65533/poc-ssrf-sentinel`;\n\nconst body = METHOD === 'GET'\n  ? null\n  : JSON.stringify({ \"input\": PAYLOAD });\n\nconst headers = { 'Content-Type': 'application/json' };\n\nconst reqUrl = METHOD === 'GET'\n  ? URL_ + (URL_.includes('?') ? '&' : '?') + \"input\" + '=' + encodeURIComponent(PAYLOAD)\n  : URL_;\n\ntry {\n  const r = await fetch(reqUrl, { method: METHOD, headers, body, redirect: 'follow' });\n  const text = await r.text();\n  const sig = (text.includes(\"http://127.0.0.1:65533/poc-ssrf-sentinel\") ? 'payload reflected' : '');\n  if (sig) {\n    process.stderr.write('PoC: exploit demonstrated — ' + sig + '\\n');\n    process.exit(0);\n  }\n  process.stderr.write('PoC: payload sent (status ' + r.status + '), no exploit evidence in response\\n');\n  process.exit(1);\n} catch (e) {\n  process.stderr.write('PoC: error reaching target — ' + e.message + '\\n');\n  process.exit(2);\n}\n"
+        "code": "// Demonstrates SSRF by forcing the server to fetch a localhost sentinel URL.\n// Endpoint:   POST http://localhost:3000/REPLACE-WITH-ENDPOINT\n// Payload:    http://127.0.0.1:65533/poc-ssrf-sentinel\n// Expect:     sentinel server logs a request from the target — proves the target made an outbound call we controlled\n// Run:        node poc.mjs\n// Exit code:  0 = exploit demonstrated, 1 = not demonstrated, 2 = error\n\nconst URL_ = \"http://localhost:3000/REPLACE-WITH-ENDPOINT\";\nconst METHOD = \"POST\";\nconst PAYLOAD = `http://127.0.0.1:65533/poc-ssrf-sentinel`;\n\nconst body = METHOD === 'GET'\n  ? null\n  : JSON.stringify({ \"input\": PAYLOAD });\n\nconst headers = { 'Content-Type': 'application/json' };\n\nconst reqUrl = METHOD === 'GET'\n  ? URL_ + (URL_.includes('?') ? '&' : '?') + \"input\" + '=' + encodeURIComponent(PAYLOAD)\n  : URL_;\n\ntry {\n  const r = await fetch(reqUrl, { method: METHOD, headers, body, redirect: 'follow' });\n  const text = await r.text();\n  const sig = (text.includes(\"http://127.0.0.1:65533/poc-ssrf-sentinel\") ? 'payload reflected' : '');\n  if (sig) {\n    process.stderr.write('PoC: exploit demonstrated — ' + sig + '\\n');\n    process.exit(0);\n  }\n  process.stderr.write('PoC: payload sent (status ' + r.status + '), no exploit evidence in response\\n');\n  process.exit(1);\n} catch (e) {\n  process.stderr.write('PoC: error reaching target — ' + e.message + '\\n');\n  process.exit(2);\n}\n",
+        "paramKey": null,
+        "paramKeyConfidence": "low",
+        "paramKeyInferred": false
       },
       "calibrated_confidence": null,
       "calibrated_confidence_ci": null,
@@ -44597,6 +44889,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -44819,6 +45112,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -45043,6 +45337,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -45265,6 +45560,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -45489,6 +45785,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -45713,6 +46010,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -45935,6 +46233,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -46157,6 +46456,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -46381,6 +46681,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -46605,6 +46906,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -46827,6 +47129,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -47049,6 +47352,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -47271,6 +47575,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -47495,6 +47800,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -47719,6 +48025,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -47943,6 +48250,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -48167,6 +48475,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -48391,6 +48700,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -48613,6 +48923,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -48835,6 +49146,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -49057,6 +49369,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -49281,6 +49594,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -49503,6 +49817,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -49725,6 +50040,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -49947,15 +50263,16 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "ssrf",
+      "parser": "SSRF-METADATA",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
       "regression_test": {
         "lang": "node",
-        "framework": "jest",
-        "filename": "security_76922713e8b5ce41.test.mjs",
-        "runHint": "npx jest",
-        "code": "// Regression test for SSRF: explicit reference to cloud instance-metadata endpoint (CWE-918).\n// Auto-generated from P1.1 PoC; fails on vulnerable code, passes after the fix.\n\nimport { test, expect } from '@jest/globals';\n\ntest('SSRF: explicit reference to cloud instance-metadata endpoint', async () => {\n  const URL_ = \"http://localhost:3000/REPLACE-WITH-ENDPOINT\";\n  const METHOD = \"POST\";\n  const PAYLOAD = \"http://127.0.0.1:65533/poc-ssrf-sentinel\";\n  const body = METHOD === 'GET' ? null : JSON.stringify({ input: PAYLOAD });\n  const reqUrl = METHOD === 'GET'\n    ? URL_ + (URL_.includes('?') ? '&' : '?') + 'input=' + encodeURIComponent(PAYLOAD)\n    : URL_;\n  const r = await fetch(reqUrl, { method: METHOD, headers: { 'Content-Type': 'application/json' }, body });\n  const text = await r.text();\n  // The assertion below is the \"exploit demonstrated\" signal — when this\n  // test PASSES, the vuln is still present. After the fix, this assertion\n  // SHOULD fail. Inverse the assertion in a green build.\n  const demonstrated = text.includes('PoC') || /syntax error/i.test(text) || text.includes('<script>');\n  expect(demonstrated).toBe(false);\n});\n"
+        "framework": null,
+        "filename": null,
+        "runHint": null,
+        "code": null
       },
       "poc": {
         "lang": "node",
@@ -49963,7 +50280,10 @@
         "cwe": "CWE-918",
         "family": "ssrf",
         "runHint": "node poc.mjs",
-        "code": "// Demonstrates SSRF by forcing the server to fetch a localhost sentinel URL.\n// Endpoint:   POST http://localhost:3000/REPLACE-WITH-ENDPOINT\n// Payload:    http://127.0.0.1:65533/poc-ssrf-sentinel\n// Expect:     sentinel server logs a request from the target — proves the target made an outbound call we controlled\n// Run:        node poc.mjs\n// Exit code:  0 = exploit demonstrated, 1 = not demonstrated, 2 = error\n\nconst URL_ = \"http://localhost:3000/REPLACE-WITH-ENDPOINT\";\nconst METHOD = \"POST\";\nconst PAYLOAD = `http://127.0.0.1:65533/poc-ssrf-sentinel`;\n\nconst body = METHOD === 'GET'\n  ? null\n  : JSON.stringify({ \"input\": PAYLOAD });\n\nconst headers = { 'Content-Type': 'application/json' };\n\nconst reqUrl = METHOD === 'GET'\n  ? URL_ + (URL_.includes('?') ? '&' : '?') + \"input\" + '=' + encodeURIComponent(PAYLOAD)\n  : URL_;\n\ntry {\n  const r = await fetch(reqUrl, { method: METHOD, headers, body, redirect: 'follow' });\n  const text = await r.text();\n  const sig = (text.includes(\"http://127.0.0.1:65533/poc-ssrf-sentinel\") ? 'payload reflected' : '');\n  if (sig) {\n    process.stderr.write('PoC: exploit demonstrated — ' + sig + '\\n');\n    process.exit(0);\n  }\n  process.stderr.write('PoC: payload sent (status ' + r.status + '), no exploit evidence in response\\n');\n  process.exit(1);\n} catch (e) {\n  process.stderr.write('PoC: error reaching target — ' + e.message + '\\n');\n  process.exit(2);\n}\n"
+        "code": "// Demonstrates SSRF by forcing the server to fetch a localhost sentinel URL.\n// Endpoint:   POST http://localhost:3000/REPLACE-WITH-ENDPOINT\n// Payload:    http://127.0.0.1:65533/poc-ssrf-sentinel\n// Expect:     sentinel server logs a request from the target — proves the target made an outbound call we controlled\n// Run:        node poc.mjs\n// Exit code:  0 = exploit demonstrated, 1 = not demonstrated, 2 = error\n\nconst URL_ = \"http://localhost:3000/REPLACE-WITH-ENDPOINT\";\nconst METHOD = \"POST\";\nconst PAYLOAD = `http://127.0.0.1:65533/poc-ssrf-sentinel`;\n\nconst body = METHOD === 'GET'\n  ? null\n  : JSON.stringify({ \"input\": PAYLOAD });\n\nconst headers = { 'Content-Type': 'application/json' };\n\nconst reqUrl = METHOD === 'GET'\n  ? URL_ + (URL_.includes('?') ? '&' : '?') + \"input\" + '=' + encodeURIComponent(PAYLOAD)\n  : URL_;\n\ntry {\n  const r = await fetch(reqUrl, { method: METHOD, headers, body, redirect: 'follow' });\n  const text = await r.text();\n  const sig = (text.includes(\"http://127.0.0.1:65533/poc-ssrf-sentinel\") ? 'payload reflected' : '');\n  if (sig) {\n    process.stderr.write('PoC: exploit demonstrated — ' + sig + '\\n');\n    process.exit(0);\n  }\n  process.stderr.write('PoC: payload sent (status ' + r.status + '), no exploit evidence in response\\n');\n  process.exit(1);\n} catch (e) {\n  process.stderr.write('PoC: error reaching target — ' + e.message + '\\n');\n  process.exit(2);\n}\n",
+        "paramKey": null,
+        "paramKeyConfidence": "low",
+        "paramKeyInferred": false
       },
       "calibrated_confidence": null,
       "calibrated_confidence_ci": null,
@@ -50191,6 +50511,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -50413,6 +50734,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "toctou-file-existence-permission-check-b",
+      "parser": "TOCTOU",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -51235,5 +51557,6 @@
       "alarms": [],
       "note": "no-feedback-data"
     }
-  }
+  },
+  "annotatorErrors": []
 }