@clear-capabilities/agentic-security-scanner 0.78.0 → 0.79.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (76) hide show
  1. package/bin/.agentic-security/findings.json +16 -16
  2. package/bin/.agentic-security/last-scan.json +16 -16
  3. package/bin/.agentic-security/last-scan.json.sig +1 -1
  4. package/bin/.agentic-security/scan-history.json +51 -0
  5. package/bin/.agentic-security/streak.json +5 -5
  6. package/bin/agentic-security.js +22 -7
  7. package/dist/178.index.js +1 -1
  8. package/dist/384.index.js +1 -1
  9. package/dist/476.index.js +5 -5
  10. package/dist/637.index.js +1 -1
  11. package/dist/700.index.js +138 -0
  12. package/dist/718.index.js +53 -0
  13. package/dist/838.index.js +1 -1
  14. package/dist/985.index.js +5 -0
  15. package/dist/agentic-security.mjs +1 -1
  16. package/dist/agentic-security.mjs.sha256 +1 -1
  17. package/package.json +2 -2
  18. package/src/dataflow/engine.js +52 -8
  19. package/src/engine.js +107 -6
  20. package/src/integrations/index.js +2 -1
  21. package/src/ir/callgraph.js +27 -7
  22. package/src/llm-validator/index.js +7 -5
  23. package/src/mcp/audit.js +5 -0
  24. package/src/posture/calibration-drift.js +2 -1
  25. package/src/posture/calibration.js +3 -2
  26. package/src/posture/fix-history.js +8 -2
  27. package/src/posture/profile.js +4 -5
  28. package/src/posture/rule-overrides.js +2 -3
  29. package/src/posture/rule-pack-signing.js +2 -3
  30. package/src/posture/rule-synthesis.js +5 -6
  31. package/src/posture/security-trend.js +4 -7
  32. package/src/posture/state-dir.js +124 -0
  33. package/src/posture/streak.js +3 -0
  34. package/src/posture/suppressions.js +5 -8
  35. package/src/posture/triage.js +3 -5
  36. package/src/posture/validator-metrics.js +3 -6
  37. package/src/sast/db-taint.js +24 -0
  38. package/src/sast/rust.js +26 -0
  39. package/src/sca/binary-metadata.js +124 -0
  40. package/src/sca/py-package-functions.js +118 -0
  41. package/src/sca/vendor-detect.js +53 -0
  42. package/src/.agentic-security/findings.json +0 -82642
  43. package/src/.agentic-security/last-scan.json +0 -82642
  44. package/src/.agentic-security/last-scan.json.sig +0 -1
  45. package/src/.agentic-security/scan-history.json +0 -10054
  46. package/src/.agentic-security/streak.json +0 -21
  47. package/src/dataflow/.agentic-security/findings.json +0 -3515
  48. package/src/dataflow/.agentic-security/last-scan.json +0 -3515
  49. package/src/dataflow/.agentic-security/last-scan.json.sig +0 -1
  50. package/src/dataflow/.agentic-security/scan-history.json +0 -702
  51. package/src/dataflow/.agentic-security/streak.json +0 -22
  52. package/src/ir/.agentic-security/findings.json +0 -3777
  53. package/src/ir/.agentic-security/last-scan.json +0 -3777
  54. package/src/ir/.agentic-security/last-scan.json.sig +0 -1
  55. package/src/ir/.agentic-security/scan-history.json +0 -771
  56. package/src/ir/.agentic-security/streak.json +0 -21
  57. package/src/posture/.agentic-security/findings.json +0 -51562
  58. package/src/posture/.agentic-security/last-scan.json +0 -51562
  59. package/src/posture/.agentic-security/last-scan.json.sig +0 -1
  60. package/src/posture/.agentic-security/scan-history.json +0 -650
  61. package/src/posture/.agentic-security/streak.json +0 -20
  62. package/src/report/.agentic-security/findings.json +0 -80
  63. package/src/report/.agentic-security/last-scan.json +0 -80
  64. package/src/report/.agentic-security/last-scan.json.sig +0 -1
  65. package/src/report/.agentic-security/scan-history.json +0 -35
  66. package/src/report/.agentic-security/streak.json +0 -22
  67. package/src/sast/.agentic-security/findings.json +0 -5190
  68. package/src/sast/.agentic-security/last-scan.json +0 -5190
  69. package/src/sast/.agentic-security/last-scan.json.sig +0 -1
  70. package/src/sast/.agentic-security/scan-history.json +0 -408
  71. package/src/sast/.agentic-security/streak.json +0 -20
  72. package/src/sca/.agentic-security/findings.json +0 -1587
  73. package/src/sca/.agentic-security/last-scan.json +0 -1587
  74. package/src/sca/.agentic-security/last-scan.json.sig +0 -1
  75. package/src/sca/.agentic-security/scan-history.json +0 -36
  76. package/src/sca/.agentic-security/streak.json +0 -21
package/src/posture/.agentic-security/scan-history.json DELETED
@@ -1,650 +0,0 @@
1
- [
2
- {
3
- "timestamp": "2026-05-27T11:16:44.690Z",
4
- "label": "scan",
5
- "total": 204,
6
- "critical": 0,
7
- "high": 0,
8
- "medium": 11,
9
- "low": 193,
10
- "kev": 0,
11
- "ids": [
12
- "llm-redteam:noMaxTokens:aibom.js:31",
13
- "llm-redteam:noMaxTokens:aibom.js:34",
14
- "llm-redteam:userInputInSystem:adversary-agent.js:109",
15
- "prompt-firewall:MISSING_MAX_TOKENS:aibom.js:31",
16
- "prompt-tpl:llm-redteam-prompts.js:332:Prompt_Template__user_input_interpolated_into_prompt_string_",
17
- "prototype-pollution-direct:adversarial-self-test.js:60",
18
- "ssrf-meta-hardcoded:attack-playbooks.js:72",
19
- "ssrf-meta-hardcoded:defender-agent.js:41",
20
- "ssrf-meta-hardcoded:flow-narration.js:24",
21
- "ssrf-meta-hardcoded:verifier.js:55",
22
- "state-machine:business-logic.js:141:<not in set>",
23
- "state-machine:fix-history.js:255:failed",
24
- "state-machine:fix-history.js:261:applied",
25
- "state-machine:fix-history.js:306:failed",
26
- "state-machine:fix-history.js:316:applied-stale",
27
- "state-machine:fix-history.js:319:applied",
28
- "state-machine:fix-history.js:324:failed",
29
- "state-machine:fix-history.js:329:failed",
30
- "state-machine:triage.js:58:fixed",
31
- "struct:agents-memory.js:103:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
32
- "struct:agents-memory.js:107:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
33
- "struct:agents-memory.js:117:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
34
- "struct:agents-memory.js:44:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
35
- "struct:agents-memory.js:45:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
36
- "struct:agents-memory.js:69:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
37
- "struct:agents-memory.js:70:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
38
- "struct:agents-memory.js:72:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
39
- "struct:agents-memory.js:82:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
40
- "struct:auth-posture-import.js:53:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
41
- "struct:auth-posture-import.js:55:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
42
- "struct:blast-radius.js:201:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
43
- "struct:blast-radius.js:202:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
44
- "struct:blast-radius.js:289:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
45
- "struct:blast-radius.js:291:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
46
- "struct:blast-radius.js:293:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
47
- "struct:blast-radius.js:332:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
48
- "struct:blast-radius.js:334:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
49
- "struct:blast-radius.js:369:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
50
- "struct:blast-radius.js:370:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
51
- "struct:blast-radius.js:387:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
52
- "struct:calibration-drift.js:39:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
53
- "struct:calibration-drift.js:40:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
54
- "struct:calibration.js:108:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
55
- "struct:calibration.js:98:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
56
- "struct:custom-rules.js:323:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
57
- "struct:custom-rules.js:345:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
58
- "struct:custom-rules.js:57:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
59
- "struct:custom-rules.js:60:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
60
- "struct:custom-rules.js:94:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
61
- "struct:cve-alert-daemon.js:218:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
62
- "struct:cve-alert-daemon.js:228:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
63
- "struct:cve-alert-daemon.js:271:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
64
- "struct:cve-alert-daemon.js:273:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
65
- "struct:cve-alert-daemon.js:281:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
66
- "struct:cve-alert-daemon.js:289:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
67
- "struct:cve-alert-daemon.js:290:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
68
- "struct:cve-lookup.js:32:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
69
- "struct:cve-lookup.js:34:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
70
- "struct:cve-lookup.js:40:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
71
- "struct:deploy-platform.js:13:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
72
- "struct:deploy-platform.js:16:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
73
- "struct:deterministic.js:47:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
74
- "struct:deterministic.js:53:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
75
- "struct:deterministic.js:54:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
76
- "struct:epss.js:34:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
77
- "struct:epss.js:36:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
78
- "struct:epss.js:38:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
79
- "struct:epss.js:44:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
80
- "struct:exploitability-probability.js:142:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
81
- "struct:exploitability-probability.js:145:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
82
- "struct:feature-flags.js:53:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
83
- "struct:feature-flags.js:54:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
84
- "struct:fix-history.js:25:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
85
- "struct:fix-history.js:26:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
86
- "struct:fix-history.js:30:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
87
- "struct:fix-history.js:348:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
88
- "struct:fix-history.js:42:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
89
- "struct:fix-history.js:43:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
90
- "struct:fix-plan.js:111:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
91
- "struct:fix-verify-loop.js:33:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
92
- "struct:fix-verify-loop.js:36:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
93
- "struct:fix-verify.js:65:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
94
- "struct:grader-calibration.js:34:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
95
- "struct:grader-calibration.js:35:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
96
- "struct:grader-calibration.js:43:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
97
- "struct:holdout-eval.js:53:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
98
- "struct:holdout-eval.js:54:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
99
- "struct:integrity.js:43:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
100
- "struct:integrity.js:44:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
101
- "struct:integrity.js:52:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
102
- "struct:integrity.js:69:Mass_Assignment_(req.body_Direct_to_Model)",
103
- "struct:integrity.js:77:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
104
- "struct:integrity.js:79:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
105
- "struct:integrity.js:83:Mass_Assignment_(req.body_Direct_to_Model)",
106
- "struct:learning.js:30:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
107
- "struct:learning.js:31:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
108
- "struct:learning.js:39:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
109
- "struct:license-policy.js:30:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
110
- "struct:license-policy.js:32:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
111
- "struct:network-policy-import.js:49:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
112
- "struct:network-policy-import.js:51:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
113
- "struct:network-policy-import.js:54:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
114
- "struct:network-policy-import.js:85:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
115
- "struct:network-policy-import.js:87:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
116
- "struct:policy-gate.js:154:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
117
- "struct:policy-gate.js:157:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
118
- "struct:policy-gate.js:162:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
119
- "struct:pre-incident-archaeology.js:31:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
120
- "struct:profile.js:45:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
121
- "struct:profile.js:46:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
122
- "struct:profile.js:66:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
123
- "struct:profile.js:78:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
124
- "struct:profile.js:82:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
125
- "struct:router.js:21:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
126
- "struct:router.js:22:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
127
- "struct:router.js:26:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
128
- "struct:router.js:27:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
129
- "struct:rule-overrides.js:23:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
130
- "struct:rule-overrides.js:25:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
131
- "struct:rule-overrides.js:73:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
132
- "struct:rule-overrides.js:75:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
133
- "struct:rule-overrides.js:78:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
134
- "struct:rule-pack-signing.js:109:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
135
- "struct:rule-pack-signing.js:154:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
136
- "struct:rule-pack-signing.js:155:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
137
- "struct:rule-pack-signing.js:156:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
138
- "struct:rule-pack-signing.js:199:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
139
- "struct:rule-pack-signing.js:207:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
140
- "struct:rule-pack-signing.js:67:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
141
- "struct:rule-pack-signing.js:69:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
142
- "struct:rule-synthesis.js:100:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
143
- "struct:rule-synthesis.js:24:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
144
- "struct:rule-synthesis.js:25:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
145
- "struct:ruleset-version.js:36:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
146
- "struct:ruleset-version.js:37:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
147
- "struct:security-trend.js:16:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
148
- "struct:security-trend.js:26:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
149
- "struct:stack-playbook.js:13:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
150
- "struct:stack-playbook.js:14:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
151
- "struct:streak.js:179:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
152
- "struct:streak.js:188:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
153
- "struct:streak.js:39:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
154
- "struct:suppressions.js:26:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
155
- "struct:suppressions.js:28:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
156
- "struct:suppressions.js:36:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
157
- "struct:suppressions.js:59:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
158
- "struct:telemetry-ingest.js:41:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
159
- "struct:telemetry-ingest.js:43:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
160
- "struct:triage.js:18:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
161
- "struct:triage.js:19:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
162
- "struct:triage.js:26:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
163
- "struct:validator-metrics.js:35:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
164
- "struct:validator-metrics.js:36:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
165
- "struct:validator-metrics.js:44:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
166
- "struct:verifier-ephemeral.js:90:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
167
- "struct:verifier-target.js:66:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
168
- "struct:verifier-target.js:68:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
169
- "struct:verifier.js:129:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
170
- "struct:version.js:43:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
171
- "struct:version.js:44:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
172
- "struct:waf-ingest.js:138:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
173
- "struct:waf-ingest.js:140:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
174
- "toctou-fs:agents-memory.js:107",
175
- "toctou-fs:agents-memory.js:44",
176
- "toctou-fs:agents-memory.js:69",
177
- "toctou-fs:agents-memory.js:72",
178
- "toctou-fs:auth-posture-import.js:53",
179
- "toctou-fs:calibration-drift.js:39",
180
- "toctou-fs:cve-alert-daemon.js:271",
181
- "toctou-fs:cve-alert-daemon.js:289",
182
- "toctou-fs:cve-lookup.js:32",
183
- "toctou-fs:deterministic.js:53",
184
- "toctou-fs:epss.js:34",
185
- "toctou-fs:exploitability-probability.js:142",
186
- "toctou-fs:feature-flags.js:53",
187
- "toctou-fs:fix-history.js:25",
188
- "toctou-fs:fix-history.js:42",
189
- "toctou-fs:fix-verify-loop.js:33",
190
- "toctou-fs:grader-calibration.js:34",
191
- "toctou-fs:harness-discovery.js:39",
192
- "toctou-fs:holdout-eval.js:53",
193
- "toctou-fs:integrity.js:43",
194
- "toctou-fs:integrity.js:77",
195
- "toctou-fs:learning.js:30",
196
- "toctou-fs:license-policy.js:30",
197
- "toctou-fs:network-policy-import.js:85",
198
- "toctou-fs:policy-gate.js:154",
199
- "toctou-fs:profile.js:45",
200
- "toctou-fs:profile.js:78",
201
- "toctou-fs:router.js:21",
202
- "toctou-fs:rule-overrides.js:23",
203
- "toctou-fs:rule-overrides.js:73",
204
- "toctou-fs:rule-pack-signing.js:109",
205
- "toctou-fs:rule-pack-signing.js:156",
206
- "toctou-fs:rule-pack-signing.js:67",
207
- "toctou-fs:rule-synthesis.js:24",
208
- "toctou-fs:ruleset-version.js:36",
209
- "toctou-fs:suppressions.js:26",
210
- "toctou-fs:telemetry-ingest.js:41",
211
- "toctou-fs:triage.js:18",
212
- "toctou-fs:validator-metrics.js:35",
213
- "toctou-fs:verifier-target.js:66",
214
- "toctou-fs:version.js:43",
215
- "toctou-fs:waf-ingest.js:138"
216
- ]
217
- },
218
- {
219
- "timestamp": "2026-05-27T11:18:32.723Z",
220
- "label": "scan",
221
- "total": 204,
222
- "critical": 0,
223
- "high": 0,
224
- "medium": 11,
225
- "low": 193,
226
- "kev": 0,
227
- "ids": [
228
- "llm-redteam:noMaxTokens:aibom.js:31",
229
- "llm-redteam:noMaxTokens:aibom.js:34",
230
- "llm-redteam:userInputInSystem:adversary-agent.js:109",
231
- "prompt-firewall:MISSING_MAX_TOKENS:aibom.js:31",
232
- "prompt-tpl:llm-redteam-prompts.js:332:Prompt_Template__user_input_interpolated_into_prompt_string_",
233
- "prototype-pollution-direct:adversarial-self-test.js:60",
234
- "ssrf-meta-hardcoded:attack-playbooks.js:72",
235
- "ssrf-meta-hardcoded:defender-agent.js:41",
236
- "ssrf-meta-hardcoded:flow-narration.js:24",
237
- "ssrf-meta-hardcoded:verifier.js:55",
238
- "state-machine:business-logic.js:141:<not in set>",
239
- "state-machine:fix-history.js:255:failed",
240
- "state-machine:fix-history.js:261:applied",
241
- "state-machine:fix-history.js:306:failed",
242
- "state-machine:fix-history.js:316:applied-stale",
243
- "state-machine:fix-history.js:319:applied",
244
- "state-machine:fix-history.js:324:failed",
245
- "state-machine:fix-history.js:329:failed",
246
- "state-machine:triage.js:58:fixed",
247
- "struct:agents-memory.js:103:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
248
- "struct:agents-memory.js:107:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
249
- "struct:agents-memory.js:117:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
250
- "struct:agents-memory.js:44:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
251
- "struct:agents-memory.js:45:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
252
- "struct:agents-memory.js:69:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
253
- "struct:agents-memory.js:70:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
254
- "struct:agents-memory.js:72:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
255
- "struct:agents-memory.js:82:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
256
- "struct:auth-posture-import.js:53:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
257
- "struct:auth-posture-import.js:55:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
258
- "struct:blast-radius.js:201:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
259
- "struct:blast-radius.js:202:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
260
- "struct:blast-radius.js:289:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
261
- "struct:blast-radius.js:291:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
262
- "struct:blast-radius.js:293:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
263
- "struct:blast-radius.js:332:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
264
- "struct:blast-radius.js:334:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
265
- "struct:blast-radius.js:369:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
266
- "struct:blast-radius.js:370:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
267
- "struct:blast-radius.js:387:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
268
- "struct:calibration-drift.js:39:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
269
- "struct:calibration-drift.js:40:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
270
- "struct:calibration.js:108:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
271
- "struct:calibration.js:98:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
272
- "struct:custom-rules.js:323:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
273
- "struct:custom-rules.js:345:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
274
- "struct:custom-rules.js:57:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
275
- "struct:custom-rules.js:60:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
276
- "struct:custom-rules.js:94:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
277
- "struct:cve-alert-daemon.js:218:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
278
- "struct:cve-alert-daemon.js:228:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
279
- "struct:cve-alert-daemon.js:271:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
280
- "struct:cve-alert-daemon.js:273:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
281
- "struct:cve-alert-daemon.js:281:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
282
- "struct:cve-alert-daemon.js:289:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
283
- "struct:cve-alert-daemon.js:290:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
284
- "struct:cve-lookup.js:32:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
285
- "struct:cve-lookup.js:34:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
286
- "struct:cve-lookup.js:40:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
287
- "struct:deploy-platform.js:13:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
288
- "struct:deploy-platform.js:16:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
289
- "struct:deterministic.js:47:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
290
- "struct:deterministic.js:53:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
291
- "struct:deterministic.js:54:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
292
- "struct:epss.js:34:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
293
- "struct:epss.js:36:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
294
- "struct:epss.js:38:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
295
- "struct:epss.js:44:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
296
- "struct:exploitability-probability.js:142:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
297
- "struct:exploitability-probability.js:145:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
298
- "struct:feature-flags.js:53:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
299
- "struct:feature-flags.js:54:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
300
- "struct:fix-history.js:25:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
301
- "struct:fix-history.js:26:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
302
- "struct:fix-history.js:30:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
303
- "struct:fix-history.js:348:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
304
- "struct:fix-history.js:42:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
305
- "struct:fix-history.js:43:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
306
- "struct:fix-plan.js:111:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
307
- "struct:fix-verify-loop.js:33:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
308
- "struct:fix-verify-loop.js:36:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
309
- "struct:fix-verify.js:65:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
310
- "struct:grader-calibration.js:34:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
311
- "struct:grader-calibration.js:35:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
312
- "struct:grader-calibration.js:43:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
313
- "struct:holdout-eval.js:53:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
314
- "struct:holdout-eval.js:54:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
315
- "struct:integrity.js:43:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
316
- "struct:integrity.js:44:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
317
- "struct:integrity.js:52:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
318
- "struct:integrity.js:69:Mass_Assignment_(req.body_Direct_to_Model)",
319
- "struct:integrity.js:77:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
320
- "struct:integrity.js:79:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
321
- "struct:integrity.js:83:Mass_Assignment_(req.body_Direct_to_Model)",
322
- "struct:learning.js:30:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
323
- "struct:learning.js:31:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
324
- "struct:learning.js:39:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
325
- "struct:license-policy.js:30:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
326
- "struct:license-policy.js:32:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
327
- "struct:network-policy-import.js:49:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
328
- "struct:network-policy-import.js:51:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
329
- "struct:network-policy-import.js:54:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
330
- "struct:network-policy-import.js:85:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
331
- "struct:network-policy-import.js:87:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
332
- "struct:policy-gate.js:154:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
333
- "struct:policy-gate.js:157:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
334
- "struct:policy-gate.js:162:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
335
- "struct:pre-incident-archaeology.js:31:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
336
- "struct:profile.js:45:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
337
- "struct:profile.js:46:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
338
- "struct:profile.js:66:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
339
- "struct:profile.js:78:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
340
- "struct:profile.js:82:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
341
- "struct:router.js:21:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
342
- "struct:router.js:22:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
343
- "struct:router.js:26:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
344
- "struct:router.js:27:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
345
- "struct:rule-overrides.js:23:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
346
- "struct:rule-overrides.js:25:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
347
- "struct:rule-overrides.js:73:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
348
- "struct:rule-overrides.js:75:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
349
- "struct:rule-overrides.js:78:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
350
- "struct:rule-pack-signing.js:109:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
351
- "struct:rule-pack-signing.js:154:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
352
- "struct:rule-pack-signing.js:155:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
353
- "struct:rule-pack-signing.js:156:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
354
- "struct:rule-pack-signing.js:199:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
355
- "struct:rule-pack-signing.js:207:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
356
- "struct:rule-pack-signing.js:67:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
357
- "struct:rule-pack-signing.js:69:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
358
- "struct:rule-synthesis.js:100:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
359
- "struct:rule-synthesis.js:24:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
360
- "struct:rule-synthesis.js:25:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
361
- "struct:ruleset-version.js:36:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
362
- "struct:ruleset-version.js:37:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
363
- "struct:security-trend.js:16:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
364
- "struct:security-trend.js:26:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
365
- "struct:stack-playbook.js:13:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
366
- "struct:stack-playbook.js:14:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
367
- "struct:streak.js:179:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
368
- "struct:streak.js:188:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
369
- "struct:streak.js:39:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
370
- "struct:suppressions.js:26:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
371
- "struct:suppressions.js:28:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
372
- "struct:suppressions.js:36:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
373
- "struct:suppressions.js:59:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
374
- "struct:telemetry-ingest.js:41:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
375
- "struct:telemetry-ingest.js:43:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
376
- "struct:triage.js:18:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
377
- "struct:triage.js:19:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
378
- "struct:triage.js:26:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
379
- "struct:validator-metrics.js:35:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
380
- "struct:validator-metrics.js:36:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
381
- "struct:validator-metrics.js:44:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
382
- "struct:verifier-ephemeral.js:90:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
383
- "struct:verifier-target.js:66:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
384
- "struct:verifier-target.js:68:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
385
- "struct:verifier.js:129:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
386
- "struct:version.js:43:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
387
- "struct:version.js:44:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
388
- "struct:waf-ingest.js:138:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
389
- "struct:waf-ingest.js:140:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
390
- "toctou-fs:agents-memory.js:107",
391
- "toctou-fs:agents-memory.js:44",
392
- "toctou-fs:agents-memory.js:69",
393
- "toctou-fs:agents-memory.js:72",
394
- "toctou-fs:auth-posture-import.js:53",
395
- "toctou-fs:calibration-drift.js:39",
396
- "toctou-fs:cve-alert-daemon.js:271",
397
- "toctou-fs:cve-alert-daemon.js:289",
398
- "toctou-fs:cve-lookup.js:32",
399
- "toctou-fs:deterministic.js:53",
400
- "toctou-fs:epss.js:34",
401
- "toctou-fs:exploitability-probability.js:142",
402
- "toctou-fs:feature-flags.js:53",
403
- "toctou-fs:fix-history.js:25",
404
- "toctou-fs:fix-history.js:42",
405
- "toctou-fs:fix-verify-loop.js:33",
406
- "toctou-fs:grader-calibration.js:34",
407
- "toctou-fs:harness-discovery.js:39",
408
- "toctou-fs:holdout-eval.js:53",
409
- "toctou-fs:integrity.js:43",
410
- "toctou-fs:integrity.js:77",
411
- "toctou-fs:learning.js:30",
412
- "toctou-fs:license-policy.js:30",
413
- "toctou-fs:network-policy-import.js:85",
414
- "toctou-fs:policy-gate.js:154",
415
- "toctou-fs:profile.js:45",
416
- "toctou-fs:profile.js:78",
417
- "toctou-fs:router.js:21",
418
- "toctou-fs:rule-overrides.js:23",
419
- "toctou-fs:rule-overrides.js:73",
420
- "toctou-fs:rule-pack-signing.js:109",
421
- "toctou-fs:rule-pack-signing.js:156",
422
- "toctou-fs:rule-pack-signing.js:67",
423
- "toctou-fs:rule-synthesis.js:24",
424
- "toctou-fs:ruleset-version.js:36",
425
- "toctou-fs:suppressions.js:26",
426
- "toctou-fs:telemetry-ingest.js:41",
427
- "toctou-fs:triage.js:18",
428
- "toctou-fs:validator-metrics.js:35",
429
- "toctou-fs:verifier-target.js:66",
430
- "toctou-fs:version.js:43",
431
- "toctou-fs:waf-ingest.js:138"
432
- ]
433
- },
434
- {
435
- "timestamp": "2026-05-27T11:19:53.822Z",
436
- "label": "scan",
437
- "total": 204,
438
- "critical": 0,
439
- "high": 0,
440
- "medium": 11,
441
- "low": 193,
442
- "kev": 0,
443
- "ids": [
444
- "llm-redteam:noMaxTokens:aibom.js:31",
445
- "llm-redteam:noMaxTokens:aibom.js:34",
446
- "llm-redteam:userInputInSystem:adversary-agent.js:109",
447
- "prompt-firewall:MISSING_MAX_TOKENS:aibom.js:31",
448
- "prompt-tpl:llm-redteam-prompts.js:332:Prompt_Template__user_input_interpolated_into_prompt_string_",
449
- "prototype-pollution-direct:adversarial-self-test.js:60",
450
- "ssrf-meta-hardcoded:attack-playbooks.js:72",
451
- "ssrf-meta-hardcoded:defender-agent.js:41",
452
- "ssrf-meta-hardcoded:flow-narration.js:24",
453
- "ssrf-meta-hardcoded:verifier.js:55",
454
- "state-machine:business-logic.js:141:<not in set>",
455
- "state-machine:fix-history.js:255:failed",
456
- "state-machine:fix-history.js:261:applied",
457
- "state-machine:fix-history.js:306:failed",
458
- "state-machine:fix-history.js:316:applied-stale",
459
- "state-machine:fix-history.js:319:applied",
460
- "state-machine:fix-history.js:324:failed",
461
- "state-machine:fix-history.js:329:failed",
462
- "state-machine:triage.js:58:fixed",
463
- "struct:agents-memory.js:103:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
464
- "struct:agents-memory.js:107:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
465
- "struct:agents-memory.js:117:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
466
- "struct:agents-memory.js:44:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
467
- "struct:agents-memory.js:45:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
468
- "struct:agents-memory.js:69:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
469
- "struct:agents-memory.js:70:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
470
- "struct:agents-memory.js:72:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
471
- "struct:agents-memory.js:82:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
472
- "struct:auth-posture-import.js:53:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
473
- "struct:auth-posture-import.js:55:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
474
- "struct:blast-radius.js:201:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
475
- "struct:blast-radius.js:202:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
476
- "struct:blast-radius.js:289:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
477
- "struct:blast-radius.js:291:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
478
- "struct:blast-radius.js:293:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
479
- "struct:blast-radius.js:332:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
480
- "struct:blast-radius.js:334:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
481
- "struct:blast-radius.js:369:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
482
- "struct:blast-radius.js:370:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
483
- "struct:blast-radius.js:387:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
484
- "struct:calibration-drift.js:39:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
485
- "struct:calibration-drift.js:40:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
486
- "struct:calibration.js:108:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
487
- "struct:calibration.js:98:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
488
- "struct:custom-rules.js:323:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
489
- "struct:custom-rules.js:345:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
490
- "struct:custom-rules.js:57:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
491
- "struct:custom-rules.js:60:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
492
- "struct:custom-rules.js:94:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
493
- "struct:cve-alert-daemon.js:218:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
494
- "struct:cve-alert-daemon.js:228:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
495
- "struct:cve-alert-daemon.js:271:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
496
- "struct:cve-alert-daemon.js:273:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
497
- "struct:cve-alert-daemon.js:281:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
498
- "struct:cve-alert-daemon.js:289:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
499
- "struct:cve-alert-daemon.js:290:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
500
- "struct:cve-lookup.js:32:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
501
- "struct:cve-lookup.js:34:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
502
- "struct:cve-lookup.js:40:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
503
- "struct:deploy-platform.js:13:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
504
- "struct:deploy-platform.js:16:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
505
- "struct:deterministic.js:47:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
506
- "struct:deterministic.js:53:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
507
- "struct:deterministic.js:54:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
508
- "struct:epss.js:34:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
509
- "struct:epss.js:36:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
510
- "struct:epss.js:38:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
511
- "struct:epss.js:44:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
512
- "struct:exploitability-probability.js:142:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
513
- "struct:exploitability-probability.js:145:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
514
- "struct:feature-flags.js:53:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
515
- "struct:feature-flags.js:54:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
516
- "struct:fix-history.js:25:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
517
- "struct:fix-history.js:26:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
518
- "struct:fix-history.js:30:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
519
- "struct:fix-history.js:348:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
520
- "struct:fix-history.js:42:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
521
- "struct:fix-history.js:43:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
522
- "struct:fix-plan.js:111:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
523
- "struct:fix-verify-loop.js:33:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
524
- "struct:fix-verify-loop.js:36:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
525
- "struct:fix-verify.js:65:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
526
- "struct:grader-calibration.js:34:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
527
- "struct:grader-calibration.js:35:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
528
- "struct:grader-calibration.js:43:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
529
- "struct:holdout-eval.js:53:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
530
- "struct:holdout-eval.js:54:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
531
- "struct:integrity.js:43:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
532
- "struct:integrity.js:44:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
533
- "struct:integrity.js:52:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
534
- "struct:integrity.js:69:Mass_Assignment_(req.body_Direct_to_Model)",
535
- "struct:integrity.js:77:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
536
- "struct:integrity.js:79:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
537
- "struct:integrity.js:83:Mass_Assignment_(req.body_Direct_to_Model)",
538
- "struct:learning.js:30:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
539
- "struct:learning.js:31:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
540
- "struct:learning.js:39:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
541
- "struct:license-policy.js:30:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
542
- "struct:license-policy.js:32:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
543
- "struct:network-policy-import.js:49:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
544
- "struct:network-policy-import.js:51:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
545
- "struct:network-policy-import.js:54:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
546
- "struct:network-policy-import.js:85:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
547
- "struct:network-policy-import.js:87:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
548
- "struct:policy-gate.js:154:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
549
- "struct:policy-gate.js:157:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
550
- "struct:policy-gate.js:162:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
551
- "struct:pre-incident-archaeology.js:31:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
552
- "struct:profile.js:45:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
553
- "struct:profile.js:46:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
554
- "struct:profile.js:66:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
555
- "struct:profile.js:78:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
556
- "struct:profile.js:82:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
557
- "struct:router.js:21:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
558
- "struct:router.js:22:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
559
- "struct:router.js:26:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
560
- "struct:router.js:27:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
561
- "struct:rule-overrides.js:23:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
562
- "struct:rule-overrides.js:25:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
563
- "struct:rule-overrides.js:73:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
564
- "struct:rule-overrides.js:75:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
565
- "struct:rule-overrides.js:78:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
566
- "struct:rule-pack-signing.js:109:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
567
- "struct:rule-pack-signing.js:154:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
568
- "struct:rule-pack-signing.js:155:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
569
- "struct:rule-pack-signing.js:156:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
570
- "struct:rule-pack-signing.js:199:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
571
- "struct:rule-pack-signing.js:207:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
572
- "struct:rule-pack-signing.js:67:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
573
- "struct:rule-pack-signing.js:69:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
574
- "struct:rule-synthesis.js:100:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
575
- "struct:rule-synthesis.js:24:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
576
- "struct:rule-synthesis.js:25:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
577
- "struct:ruleset-version.js:36:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
578
- "struct:ruleset-version.js:37:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
579
- "struct:security-trend.js:16:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
580
- "struct:security-trend.js:26:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
581
- "struct:stack-playbook.js:13:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
582
- "struct:stack-playbook.js:14:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
583
- "struct:streak.js:179:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
584
- "struct:streak.js:188:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
585
- "struct:streak.js:39:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
586
- "struct:suppressions.js:26:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
587
- "struct:suppressions.js:28:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
588
- "struct:suppressions.js:36:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
589
- "struct:suppressions.js:59:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
590
- "struct:telemetry-ingest.js:41:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
591
- "struct:telemetry-ingest.js:43:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
592
- "struct:triage.js:18:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
593
- "struct:triage.js:19:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
594
- "struct:triage.js:26:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
595
- "struct:validator-metrics.js:35:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
596
- "struct:validator-metrics.js:36:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
597
- "struct:validator-metrics.js:44:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
598
- "struct:verifier-ephemeral.js:90:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
599
- "struct:verifier-target.js:66:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
600
- "struct:verifier-target.js:68:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
601
- "struct:verifier.js:129:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
602
- "struct:version.js:43:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
603
- "struct:version.js:44:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
604
- "struct:waf-ingest.js:138:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
605
- "struct:waf-ingest.js:140:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
606
- "toctou-fs:agents-memory.js:107",
607
- "toctou-fs:agents-memory.js:44",
608
- "toctou-fs:agents-memory.js:69",
609
- "toctou-fs:agents-memory.js:72",
610
- "toctou-fs:auth-posture-import.js:53",
611
- "toctou-fs:calibration-drift.js:39",
612
- "toctou-fs:cve-alert-daemon.js:271",
613
- "toctou-fs:cve-alert-daemon.js:289",
614
- "toctou-fs:cve-lookup.js:32",
615
- "toctou-fs:deterministic.js:53",
616
- "toctou-fs:epss.js:34",
617
- "toctou-fs:exploitability-probability.js:142",
618
- "toctou-fs:feature-flags.js:53",
619
- "toctou-fs:fix-history.js:25",
620
- "toctou-fs:fix-history.js:42",
621
- "toctou-fs:fix-verify-loop.js:33",
622
- "toctou-fs:grader-calibration.js:34",
623
- "toctou-fs:harness-discovery.js:39",
624
- "toctou-fs:holdout-eval.js:53",
625
- "toctou-fs:integrity.js:43",
626
- "toctou-fs:integrity.js:77",
627
- "toctou-fs:learning.js:30",
628
- "toctou-fs:license-policy.js:30",
629
- "toctou-fs:network-policy-import.js:85",
630
- "toctou-fs:policy-gate.js:154",
631
- "toctou-fs:profile.js:45",
632
- "toctou-fs:profile.js:78",
633
- "toctou-fs:router.js:21",
634
- "toctou-fs:rule-overrides.js:23",
635
- "toctou-fs:rule-overrides.js:73",
636
- "toctou-fs:rule-pack-signing.js:109",
637
- "toctou-fs:rule-pack-signing.js:156",
638
- "toctou-fs:rule-pack-signing.js:67",
639
- "toctou-fs:rule-synthesis.js:24",
640
- "toctou-fs:ruleset-version.js:36",
641
- "toctou-fs:suppressions.js:26",
642
- "toctou-fs:telemetry-ingest.js:41",
643
- "toctou-fs:triage.js:18",
644
- "toctou-fs:validator-metrics.js:35",
645
- "toctou-fs:verifier-target.js:66",
646
- "toctou-fs:version.js:43",
647
- "toctou-fs:waf-ingest.js:138"
648
- ]
649
- }
650
- ]