@clear-capabilities/agentic-security-scanner 0.78.0 → 0.80.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (126) hide show
  1. package/bin/.agentic-security/findings.json +16 -16
  2. package/bin/.agentic-security/last-scan.json +16 -16
  3. package/bin/.agentic-security/last-scan.json.sig +1 -1
  4. package/bin/.agentic-security/scan-history.json +51 -0
  5. package/bin/.agentic-security/streak.json +5 -5
  6. package/bin/agentic-security.js +22 -7
  7. package/dist/178.index.js +1 -1
  8. package/dist/333.index.js +283 -0
  9. package/dist/384.index.js +1 -1
  10. package/dist/476.index.js +5 -5
  11. package/dist/637.index.js +1 -1
  12. package/dist/700.index.js +138 -0
  13. package/dist/718.index.js +53 -0
  14. package/dist/838.index.js +1 -1
  15. package/dist/985.index.js +95 -1
  16. package/dist/agentic-security.mjs +83 -83
  17. package/dist/agentic-security.mjs.sha256 +1 -1
  18. package/package.json +6 -4
  19. package/src/.agentic-security/findings.json +29799 -7803
  20. package/src/.agentic-security/last-scan.json +29799 -7803
  21. package/src/.agentic-security/last-scan.json.sig +1 -1
  22. package/src/.agentic-security/scan-history.json +5119 -2611
  23. package/src/.agentic-security/streak.json +6 -6
  24. package/src/dataflow/.agentic-security/findings.json +2879 -308
  25. package/src/dataflow/.agentic-security/last-scan.json +2879 -308
  26. package/src/dataflow/.agentic-security/last-scan.json.sig +1 -1
  27. package/src/dataflow/.agentic-security/scan-history.json +68 -520
  28. package/src/dataflow/.agentic-security/streak.json +6 -7
  29. package/src/dataflow/cross-service-taint.js +201 -0
  30. package/src/dataflow/engine.js +52 -8
  31. package/src/dataflow/formal-verify.js +204 -0
  32. package/src/dataflow/ifds-precise.js +222 -0
  33. package/src/dataflow/k2-summary-cache.js +153 -0
  34. package/src/dataflow/lib-taint-summaries.js +198 -0
  35. package/src/dataflow/privacy-taint.js +205 -0
  36. package/src/dataflow/smt-feasibility.js +189 -0
  37. package/src/engine.js +890 -132
  38. package/src/integrations/index.js +2 -1
  39. package/src/ir/.agentic-security/findings.json +240 -6
  40. package/src/ir/.agentic-security/last-scan.json +240 -6
  41. package/src/ir/.agentic-security/last-scan.json.sig +1 -1
  42. package/src/ir/.agentic-security/scan-history.json +16 -594
  43. package/src/ir/.agentic-security/streak.json +8 -9
  44. package/src/ir/callgraph.js +27 -7
  45. package/src/ir/cpp-preprocessor.js +142 -0
  46. package/src/ir/csharp-ir.js +604 -0
  47. package/src/ir/universal-ir.js +403 -0
  48. package/src/llm-validator/index.js +7 -5
  49. package/src/mcp/.agentic-security/findings.json +8632 -0
  50. package/src/mcp/.agentic-security/last-scan.json +8632 -0
  51. package/src/mcp/.agentic-security/last-scan.json.sig +1 -0
  52. package/src/mcp/.agentic-security/scan-history.json +143 -0
  53. package/src/mcp/.agentic-security/streak.json +20 -0
  54. package/src/mcp/audit.js +5 -0
  55. package/src/mcp/tools.js +90 -1
  56. package/src/posture/.agentic-security/findings.json +16809 -4367
  57. package/src/posture/.agentic-security/last-scan.json +16809 -4367
  58. package/src/posture/.agentic-security/last-scan.json.sig +1 -1
  59. package/src/posture/.agentic-security/scan-history.json +6689 -177
  60. package/src/posture/.agentic-security/streak.json +8 -7
  61. package/src/posture/api-contract.js +193 -0
  62. package/src/posture/attack-taxonomy.js +227 -0
  63. package/src/posture/calibration-drift.js +2 -1
  64. package/src/posture/calibration.js +3 -2
  65. package/src/posture/compliance-policy.js +218 -0
  66. package/src/posture/composite-risk.js +122 -0
  67. package/src/posture/csharp-analysis.js +330 -0
  68. package/src/posture/exploit-bundle.js +210 -0
  69. package/src/posture/federated-learning.js +172 -0
  70. package/src/posture/fix-history.js +8 -2
  71. package/src/posture/license-attributions.js +94 -0
  72. package/src/posture/license-graph.js +238 -0
  73. package/src/posture/pqc-migration-plan.js +158 -0
  74. package/src/posture/profile.js +4 -5
  75. package/src/posture/reachability-filter.js +33 -2
  76. package/src/posture/realtime-cve-monitor.js +214 -0
  77. package/src/posture/rule-overrides.js +2 -3
  78. package/src/posture/rule-pack-signing.js +2 -3
  79. package/src/posture/rule-synthesis.js +5 -6
  80. package/src/posture/runtime-correlation.js +174 -0
  81. package/src/posture/sbom-diff.js +171 -0
  82. package/src/posture/sca-policy.js +235 -0
  83. package/src/posture/sca-upgrade.js +259 -0
  84. package/src/posture/security-trend.js +4 -7
  85. package/src/posture/state-dir.js +124 -0
  86. package/src/posture/streak.js +3 -0
  87. package/src/posture/suppressions.js +5 -8
  88. package/src/posture/threat-model-auto.js +268 -0
  89. package/src/posture/triage-learning.js +170 -0
  90. package/src/posture/triage.js +29 -6
  91. package/src/posture/validator-metrics.js +3 -6
  92. package/src/sast/.agentic-security/findings.json +996 -32
  93. package/src/sast/.agentic-security/last-scan.json +996 -32
  94. package/src/sast/.agentic-security/last-scan.json.sig +1 -1
  95. package/src/sast/.agentic-security/scan-history.json +565 -32
  96. package/src/sast/.agentic-security/streak.json +10 -8
  97. package/src/sast/_secret-entropy.js +145 -0
  98. package/src/sast/cloud-iam.js +312 -0
  99. package/src/sast/cpp.js +138 -4
  100. package/src/sast/crypto-protocol.js +388 -0
  101. package/src/sast/csharp-tokenizer.js +392 -0
  102. package/src/sast/csharp.js +924 -138
  103. package/src/sast/dapp-frontend.js +200 -0
  104. package/src/sast/db-taint.js +24 -0
  105. package/src/sast/k8s-admission.js +271 -0
  106. package/src/sast/llm-app.js +272 -0
  107. package/src/sast/ml-supply-chain.js +259 -0
  108. package/src/sast/mobile.js +224 -0
  109. package/src/sast/post-quantum-crypto.js +348 -0
  110. package/src/sast/rust.js +26 -0
  111. package/src/sast/web3-advanced.js +375 -0
  112. package/src/sca/.agentic-security/findings.json +6044 -171
  113. package/src/sca/.agentic-security/last-scan.json +6044 -171
  114. package/src/sca/.agentic-security/last-scan.json.sig +1 -1
  115. package/src/sca/.agentic-security/scan-history.json +83 -6
  116. package/src/sca/.agentic-security/streak.json +9 -9
  117. package/src/sca/CLAUDE.md +161 -0
  118. package/src/sca/binary-metadata.js +146 -0
  119. package/src/sca/py-package-functions.js +118 -0
  120. package/src/sca/sigstore-verify.js +215 -0
  121. package/src/sca/vendor-detect.js +53 -0
  122. package/src/report/.agentic-security/findings.json +0 -80
  123. package/src/report/.agentic-security/last-scan.json +0 -80
  124. package/src/report/.agentic-security/last-scan.json.sig +0 -1
  125. package/src/report/.agentic-security/scan-history.json +0 -35
  126. package/src/report/.agentic-security/streak.json +0 -22
package/src/sast/.agentic-security/scan-history.json CHANGED
@@ -1,6 +1,6 @@
1
1
  [
2
2
  {
3
- "timestamp": "2026-05-26T16:30:07.351Z",
3
+ "timestamp": "2026-05-28T21:53:59.953Z",
4
4
  "label": "scan",
5
5
  "total": 17,
6
6
  "critical": 0,
@@ -29,7 +29,7 @@
29
29
  ]
30
30
  },
31
31
  {
32
- "timestamp": "2026-05-26T16:34:28.797Z",
32
+ "timestamp": "2026-05-28T21:55:15.110Z",
33
33
  "label": "scan",
34
34
  "total": 17,
35
35
  "critical": 0,
@@ -58,7 +58,7 @@
58
58
  ]
59
59
  },
60
60
  {
61
- "timestamp": "2026-05-27T01:10:20.082Z",
61
+ "timestamp": "2026-05-28T21:55:49.362Z",
62
62
  "label": "scan",
63
63
  "total": 17,
64
64
  "critical": 0,
@@ -87,7 +87,7 @@
87
87
  ]
88
88
  },
89
89
  {
90
- "timestamp": "2026-05-27T03:05:16.971Z",
90
+ "timestamp": "2026-05-28T21:56:14.244Z",
91
91
  "label": "scan",
92
92
  "total": 17,
93
93
  "critical": 0,
@@ -116,7 +116,7 @@
116
116
  ]
117
117
  },
118
118
  {
119
- "timestamp": "2026-05-27T03:18:22.550Z",
119
+ "timestamp": "2026-05-28T21:56:19.253Z",
120
120
  "label": "scan",
121
121
  "total": 17,
122
122
  "critical": 0,
@@ -145,13 +145,13 @@
145
145
  ]
146
146
  },
147
147
  {
148
- "timestamp": "2026-05-27T09:09:50.637Z",
148
+ "timestamp": "2026-05-29T06:46:02.197Z",
149
149
  "label": "scan",
150
- "total": 17,
150
+ "total": 18,
151
151
  "critical": 0,
152
152
  "high": 0,
153
153
  "medium": 2,
154
- "low": 15,
154
+ "low": 16,
155
155
  "kev": 0,
156
156
  "ids": [
157
157
  "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
@@ -162,6 +162,7 @@
162
162
  "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
163
163
  "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
164
164
  "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
165
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
165
166
  "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
166
167
  "spec-drift:rate-limit-impl:rate-limit.js:34",
167
168
  "spec-drift:rate-limit-impl:rate-limit.js:77",
@@ -174,13 +175,13 @@
174
175
  ]
175
176
  },
176
177
  {
177
- "timestamp": "2026-05-27T09:10:10.121Z",
178
+ "timestamp": "2026-05-29T06:48:50.278Z",
178
179
  "label": "scan",
179
- "total": 17,
180
+ "total": 18,
180
181
  "critical": 0,
181
182
  "high": 0,
182
183
  "medium": 2,
183
- "low": 15,
184
+ "low": 16,
184
185
  "kev": 0,
185
186
  "ids": [
186
187
  "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
@@ -191,6 +192,7 @@
191
192
  "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
192
193
  "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
193
194
  "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
195
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
194
196
  "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
195
197
  "spec-drift:rate-limit-impl:rate-limit.js:34",
196
198
  "spec-drift:rate-limit-impl:rate-limit.js:77",
@@ -203,13 +205,13 @@
203
205
  ]
204
206
  },
205
207
  {
206
- "timestamp": "2026-05-27T09:12:25.348Z",
208
+ "timestamp": "2026-05-29T14:13:35.120Z",
207
209
  "label": "scan",
208
- "total": 17,
210
+ "total": 18,
209
211
  "critical": 0,
210
212
  "high": 0,
211
213
  "medium": 2,
212
- "low": 15,
214
+ "low": 16,
213
215
  "kev": 0,
214
216
  "ids": [
215
217
  "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
@@ -220,6 +222,7 @@
220
222
  "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
221
223
  "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
222
224
  "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
225
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
223
226
  "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
224
227
  "spec-drift:rate-limit-impl:rate-limit.js:34",
225
228
  "spec-drift:rate-limit-impl:rate-limit.js:77",
@@ -232,13 +235,13 @@
232
235
  ]
233
236
  },
234
237
  {
235
- "timestamp": "2026-05-27T09:17:13.165Z",
238
+ "timestamp": "2026-05-29T14:26:21.588Z",
236
239
  "label": "scan",
237
- "total": 17,
240
+ "total": 18,
238
241
  "critical": 0,
239
242
  "high": 0,
240
243
  "medium": 2,
241
- "low": 15,
244
+ "low": 16,
242
245
  "kev": 0,
243
246
  "ids": [
244
247
  "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
@@ -249,6 +252,7 @@
249
252
  "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
250
253
  "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
251
254
  "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
255
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
252
256
  "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
253
257
  "spec-drift:rate-limit-impl:rate-limit.js:34",
254
258
  "spec-drift:rate-limit-impl:rate-limit.js:77",
@@ -261,13 +265,13 @@
261
265
  ]
262
266
  },
263
267
  {
264
- "timestamp": "2026-05-27T09:21:04.965Z",
268
+ "timestamp": "2026-05-29T14:27:33.225Z",
265
269
  "label": "scan",
266
- "total": 17,
270
+ "total": 18,
267
271
  "critical": 0,
268
272
  "high": 0,
269
273
  "medium": 2,
270
- "low": 15,
274
+ "low": 16,
271
275
  "kev": 0,
272
276
  "ids": [
273
277
  "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
@@ -278,6 +282,7 @@
278
282
  "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
279
283
  "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
280
284
  "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
285
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
281
286
  "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
282
287
  "spec-drift:rate-limit-impl:rate-limit.js:34",
283
288
  "spec-drift:rate-limit-impl:rate-limit.js:77",
@@ -290,13 +295,13 @@
290
295
  ]
291
296
  },
292
297
  {
293
- "timestamp": "2026-05-27T09:21:46.189Z",
298
+ "timestamp": "2026-05-29T14:30:05.515Z",
294
299
  "label": "scan",
295
- "total": 17,
300
+ "total": 18,
296
301
  "critical": 0,
297
302
  "high": 0,
298
303
  "medium": 2,
299
- "low": 15,
304
+ "low": 16,
300
305
  "kev": 0,
301
306
  "ids": [
302
307
  "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
@@ -307,6 +312,7 @@
307
312
  "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
308
313
  "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
309
314
  "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
315
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
310
316
  "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
311
317
  "spec-drift:rate-limit-impl:rate-limit.js:34",
312
318
  "spec-drift:rate-limit-impl:rate-limit.js:77",
@@ -319,13 +325,13 @@
319
325
  ]
320
326
  },
321
327
  {
322
- "timestamp": "2026-05-27T09:24:34.687Z",
328
+ "timestamp": "2026-05-29T15:08:40.086Z",
323
329
  "label": "scan",
324
- "total": 17,
330
+ "total": 18,
325
331
  "critical": 0,
326
332
  "high": 0,
327
333
  "medium": 2,
328
- "low": 15,
334
+ "low": 16,
329
335
  "kev": 0,
330
336
  "ids": [
331
337
  "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
@@ -336,6 +342,7 @@
336
342
  "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
337
343
  "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
338
344
  "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
345
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
339
346
  "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
340
347
  "spec-drift:rate-limit-impl:rate-limit.js:34",
341
348
  "spec-drift:rate-limit-impl:rate-limit.js:77",
@@ -348,13 +355,13 @@
348
355
  ]
349
356
  },
350
357
  {
351
- "timestamp": "2026-05-27T09:43:08.807Z",
358
+ "timestamp": "2026-05-29T15:10:05.268Z",
352
359
  "label": "scan",
353
- "total": 17,
360
+ "total": 19,
354
361
  "critical": 0,
355
362
  "high": 0,
356
363
  "medium": 2,
357
- "low": 15,
364
+ "low": 17,
358
365
  "kev": 0,
359
366
  "ids": [
360
367
  "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
@@ -365,6 +372,8 @@
365
372
  "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
366
373
  "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
367
374
  "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
375
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
376
+ "prompt-tpl:k8s-admission.js:140:Prompt_Template__user_input_interpolated_into_prompt_string_",
368
377
  "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
369
378
  "spec-drift:rate-limit-impl:rate-limit.js:34",
370
379
  "spec-drift:rate-limit-impl:rate-limit.js:77",
@@ -377,16 +386,538 @@
377
386
  ]
378
387
  },
379
388
  {
380
- "timestamp": "2026-05-27T09:43:30.205Z",
389
+ "timestamp": "2026-05-29T15:12:36.888Z",
381
390
  "label": "scan",
382
- "total": 17,
391
+ "total": 19,
383
392
  "critical": 0,
384
393
  "high": 0,
385
394
  "medium": 2,
386
- "low": 15,
395
+ "low": 17,
396
+ "kev": 0,
397
+ "ids": [
398
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
399
+ "client-side:CLIENT_EVAL:client-side.js:135",
400
+ "client-side:CLIENT_EVAL:client-side.js:139",
401
+ "client-side:CLIENT_EVAL:client-side.js:140",
402
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
403
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
404
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
405
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
406
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
407
+ "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
408
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
409
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
410
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
411
+ "ssrf-meta-hardcoded:go-extended.js:39",
412
+ "ssrf-meta-hardcoded:python-sinks.js:186",
413
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
414
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
415
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
416
+ "zip-slip:zip-slip.js:192:node-entry"
417
+ ]
418
+ },
419
+ {
420
+ "timestamp": "2026-05-29T15:12:45.140Z",
421
+ "label": "scan",
422
+ "total": 19,
423
+ "critical": 0,
424
+ "high": 0,
425
+ "medium": 2,
426
+ "low": 17,
427
+ "kev": 0,
428
+ "ids": [
429
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
430
+ "client-side:CLIENT_EVAL:client-side.js:135",
431
+ "client-side:CLIENT_EVAL:client-side.js:139",
432
+ "client-side:CLIENT_EVAL:client-side.js:140",
433
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
434
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
435
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
436
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
437
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
438
+ "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
439
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
440
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
441
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
442
+ "ssrf-meta-hardcoded:go-extended.js:39",
443
+ "ssrf-meta-hardcoded:python-sinks.js:186",
444
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
445
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
446
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
447
+ "zip-slip:zip-slip.js:192:node-entry"
448
+ ]
449
+ },
450
+ {
451
+ "timestamp": "2026-05-29T15:12:52.802Z",
452
+ "label": "scan",
453
+ "total": 19,
454
+ "critical": 0,
455
+ "high": 0,
456
+ "medium": 2,
457
+ "low": 17,
458
+ "kev": 0,
459
+ "ids": [
460
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
461
+ "client-side:CLIENT_EVAL:client-side.js:135",
462
+ "client-side:CLIENT_EVAL:client-side.js:139",
463
+ "client-side:CLIENT_EVAL:client-side.js:140",
464
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
465
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
466
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
467
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
468
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
469
+ "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
470
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
471
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
472
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
473
+ "ssrf-meta-hardcoded:go-extended.js:39",
474
+ "ssrf-meta-hardcoded:python-sinks.js:186",
475
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
476
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
477
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
478
+ "zip-slip:zip-slip.js:192:node-entry"
479
+ ]
480
+ },
481
+ {
482
+ "timestamp": "2026-05-29T15:13:01.692Z",
483
+ "label": "scan",
484
+ "total": 19,
485
+ "critical": 0,
486
+ "high": 0,
487
+ "medium": 2,
488
+ "low": 17,
489
+ "kev": 0,
490
+ "ids": [
491
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
492
+ "client-side:CLIENT_EVAL:client-side.js:135",
493
+ "client-side:CLIENT_EVAL:client-side.js:139",
494
+ "client-side:CLIENT_EVAL:client-side.js:140",
495
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
496
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
497
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
498
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
499
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
500
+ "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
501
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
502
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
503
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
504
+ "ssrf-meta-hardcoded:go-extended.js:39",
505
+ "ssrf-meta-hardcoded:python-sinks.js:186",
506
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
507
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
508
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
509
+ "zip-slip:zip-slip.js:192:node-entry"
510
+ ]
511
+ },
512
+ {
513
+ "timestamp": "2026-05-29T16:09:42.230Z",
514
+ "label": "scan",
515
+ "total": 21,
516
+ "critical": 0,
517
+ "high": 0,
518
+ "medium": 2,
519
+ "low": 19,
520
+ "kev": 0,
521
+ "ids": [
522
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
523
+ "authz:crypto-protocol.js:329:AuthZ__jwt_verify_called_without_algorithms_allow_list",
524
+ "authz:crypto-protocol.js:330:AuthZ__jwt_verify_called_without_algorithms_allow_list",
525
+ "client-side:CLIENT_EVAL:client-side.js:135",
526
+ "client-side:CLIENT_EVAL:client-side.js:139",
527
+ "client-side:CLIENT_EVAL:client-side.js:140",
528
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
529
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
530
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
531
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
532
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
533
+ "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
534
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
535
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
536
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
537
+ "ssrf-meta-hardcoded:go-extended.js:39",
538
+ "ssrf-meta-hardcoded:python-sinks.js:186",
539
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
540
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
541
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
542
+ "zip-slip:zip-slip.js:192:node-entry"
543
+ ]
544
+ },
545
+ {
546
+ "timestamp": "2026-05-29T16:12:29.038Z",
547
+ "label": "scan",
548
+ "total": 21,
549
+ "critical": 0,
550
+ "high": 0,
551
+ "medium": 2,
552
+ "low": 19,
553
+ "kev": 0,
554
+ "ids": [
555
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
556
+ "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
557
+ "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
558
+ "client-side:CLIENT_EVAL:client-side.js:135",
559
+ "client-side:CLIENT_EVAL:client-side.js:139",
560
+ "client-side:CLIENT_EVAL:client-side.js:140",
561
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
562
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
563
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
564
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
565
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
566
+ "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
567
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
568
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
569
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
570
+ "ssrf-meta-hardcoded:go-extended.js:39",
571
+ "ssrf-meta-hardcoded:python-sinks.js:186",
572
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
573
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
574
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
575
+ "zip-slip:zip-slip.js:192:node-entry"
576
+ ]
577
+ },
578
+ {
579
+ "timestamp": "2026-05-29T16:13:59.607Z",
580
+ "label": "scan",
581
+ "total": 21,
582
+ "critical": 0,
583
+ "high": 0,
584
+ "medium": 2,
585
+ "low": 19,
586
+ "kev": 0,
587
+ "ids": [
588
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
589
+ "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
590
+ "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
591
+ "client-side:CLIENT_EVAL:client-side.js:135",
592
+ "client-side:CLIENT_EVAL:client-side.js:139",
593
+ "client-side:CLIENT_EVAL:client-side.js:140",
594
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
595
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
596
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
597
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
598
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
599
+ "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
600
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
601
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
602
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
603
+ "ssrf-meta-hardcoded:go-extended.js:39",
604
+ "ssrf-meta-hardcoded:python-sinks.js:186",
605
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
606
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
607
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
608
+ "zip-slip:zip-slip.js:192:node-entry"
609
+ ]
610
+ },
611
+ {
612
+ "timestamp": "2026-05-29T16:32:06.484Z",
613
+ "label": "scan",
614
+ "total": 21,
615
+ "critical": 0,
616
+ "high": 0,
617
+ "medium": 2,
618
+ "low": 19,
619
+ "kev": 0,
620
+ "ids": [
621
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
622
+ "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
623
+ "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
624
+ "client-side:CLIENT_EVAL:client-side.js:135",
625
+ "client-side:CLIENT_EVAL:client-side.js:139",
626
+ "client-side:CLIENT_EVAL:client-side.js:140",
627
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
628
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
629
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
630
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
631
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
632
+ "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
633
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
634
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
635
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
636
+ "ssrf-meta-hardcoded:go-extended.js:39",
637
+ "ssrf-meta-hardcoded:python-sinks.js:186",
638
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
639
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
640
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
641
+ "zip-slip:zip-slip.js:192:node-entry"
642
+ ]
643
+ },
644
+ {
645
+ "timestamp": "2026-05-29T16:33:51.164Z",
646
+ "label": "scan",
647
+ "total": 21,
648
+ "critical": 0,
649
+ "high": 0,
650
+ "medium": 2,
651
+ "low": 19,
652
+ "kev": 0,
653
+ "ids": [
654
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
655
+ "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
656
+ "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
657
+ "client-side:CLIENT_EVAL:client-side.js:135",
658
+ "client-side:CLIENT_EVAL:client-side.js:139",
659
+ "client-side:CLIENT_EVAL:client-side.js:140",
660
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
661
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
662
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
663
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
664
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
665
+ "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
666
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
667
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
668
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
669
+ "ssrf-meta-hardcoded:go-extended.js:39",
670
+ "ssrf-meta-hardcoded:python-sinks.js:186",
671
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
672
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
673
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
674
+ "zip-slip:zip-slip.js:192:node-entry"
675
+ ]
676
+ },
677
+ {
678
+ "timestamp": "2026-05-29T17:02:03.828Z",
679
+ "label": "scan",
680
+ "total": 21,
681
+ "critical": 0,
682
+ "high": 0,
683
+ "medium": 2,
684
+ "low": 19,
685
+ "kev": 0,
686
+ "ids": [
687
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
688
+ "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
689
+ "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
690
+ "client-side:CLIENT_EVAL:client-side.js:135",
691
+ "client-side:CLIENT_EVAL:client-side.js:139",
692
+ "client-side:CLIENT_EVAL:client-side.js:140",
693
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
694
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
695
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
696
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
697
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
698
+ "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
699
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
700
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
701
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
702
+ "ssrf-meta-hardcoded:go-extended.js:39",
703
+ "ssrf-meta-hardcoded:python-sinks.js:186",
704
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
705
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
706
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
707
+ "zip-slip:zip-slip.js:192:node-entry"
708
+ ]
709
+ },
710
+ {
711
+ "timestamp": "2026-05-29T17:02:12.361Z",
712
+ "label": "scan",
713
+ "total": 21,
714
+ "critical": 0,
715
+ "high": 0,
716
+ "medium": 2,
717
+ "low": 19,
718
+ "kev": 0,
719
+ "ids": [
720
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
721
+ "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
722
+ "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
723
+ "client-side:CLIENT_EVAL:client-side.js:135",
724
+ "client-side:CLIENT_EVAL:client-side.js:139",
725
+ "client-side:CLIENT_EVAL:client-side.js:140",
726
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
727
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
728
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
729
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
730
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
731
+ "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
732
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
733
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
734
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
735
+ "ssrf-meta-hardcoded:go-extended.js:39",
736
+ "ssrf-meta-hardcoded:python-sinks.js:186",
737
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
738
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
739
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
740
+ "zip-slip:zip-slip.js:192:node-entry"
741
+ ]
742
+ },
743
+ {
744
+ "timestamp": "2026-05-29T17:02:20.453Z",
745
+ "label": "scan",
746
+ "total": 21,
747
+ "critical": 0,
748
+ "high": 0,
749
+ "medium": 2,
750
+ "low": 19,
751
+ "kev": 0,
752
+ "ids": [
753
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
754
+ "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
755
+ "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
756
+ "client-side:CLIENT_EVAL:client-side.js:135",
757
+ "client-side:CLIENT_EVAL:client-side.js:139",
758
+ "client-side:CLIENT_EVAL:client-side.js:140",
759
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
760
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
761
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
762
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
763
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
764
+ "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
765
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
766
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
767
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
768
+ "ssrf-meta-hardcoded:go-extended.js:39",
769
+ "ssrf-meta-hardcoded:python-sinks.js:186",
770
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
771
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
772
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
773
+ "zip-slip:zip-slip.js:192:node-entry"
774
+ ]
775
+ },
776
+ {
777
+ "timestamp": "2026-05-29T17:03:04.332Z",
778
+ "label": "scan",
779
+ "total": 21,
780
+ "critical": 0,
781
+ "high": 0,
782
+ "medium": 2,
783
+ "low": 19,
784
+ "kev": 0,
785
+ "ids": [
786
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
787
+ "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
788
+ "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
789
+ "client-side:CLIENT_EVAL:client-side.js:135",
790
+ "client-side:CLIENT_EVAL:client-side.js:139",
791
+ "client-side:CLIENT_EVAL:client-side.js:140",
792
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
793
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
794
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
795
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
796
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
797
+ "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
798
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
799
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
800
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
801
+ "ssrf-meta-hardcoded:go-extended.js:39",
802
+ "ssrf-meta-hardcoded:python-sinks.js:186",
803
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
804
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
805
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
806
+ "zip-slip:zip-slip.js:192:node-entry"
807
+ ]
808
+ },
809
+ {
810
+ "timestamp": "2026-05-29T17:03:11.818Z",
811
+ "label": "scan",
812
+ "total": 21,
813
+ "critical": 0,
814
+ "high": 0,
815
+ "medium": 2,
816
+ "low": 19,
817
+ "kev": 0,
818
+ "ids": [
819
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
820
+ "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
821
+ "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
822
+ "client-side:CLIENT_EVAL:client-side.js:135",
823
+ "client-side:CLIENT_EVAL:client-side.js:139",
824
+ "client-side:CLIENT_EVAL:client-side.js:140",
825
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
826
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
827
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
828
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
829
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
830
+ "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
831
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
832
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
833
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
834
+ "ssrf-meta-hardcoded:go-extended.js:39",
835
+ "ssrf-meta-hardcoded:python-sinks.js:186",
836
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
837
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
838
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
839
+ "zip-slip:zip-slip.js:192:node-entry"
840
+ ]
841
+ },
842
+ {
843
+ "timestamp": "2026-05-29T17:03:19.497Z",
844
+ "label": "scan",
845
+ "total": 21,
846
+ "critical": 0,
847
+ "high": 0,
848
+ "medium": 2,
849
+ "low": 19,
850
+ "kev": 0,
851
+ "ids": [
852
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
853
+ "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
854
+ "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
855
+ "client-side:CLIENT_EVAL:client-side.js:135",
856
+ "client-side:CLIENT_EVAL:client-side.js:139",
857
+ "client-side:CLIENT_EVAL:client-side.js:140",
858
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
859
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
860
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
861
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
862
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
863
+ "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
864
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
865
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
866
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
867
+ "ssrf-meta-hardcoded:go-extended.js:39",
868
+ "ssrf-meta-hardcoded:python-sinks.js:186",
869
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
870
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
871
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
872
+ "zip-slip:zip-slip.js:192:node-entry"
873
+ ]
874
+ },
875
+ {
876
+ "timestamp": "2026-05-29T17:04:00.294Z",
877
+ "label": "scan",
878
+ "total": 21,
879
+ "critical": 0,
880
+ "high": 0,
881
+ "medium": 2,
882
+ "low": 19,
883
+ "kev": 0,
884
+ "ids": [
885
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
886
+ "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
887
+ "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
888
+ "client-side:CLIENT_EVAL:client-side.js:135",
889
+ "client-side:CLIENT_EVAL:client-side.js:139",
890
+ "client-side:CLIENT_EVAL:client-side.js:140",
891
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
892
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
893
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
894
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
895
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
896
+ "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
897
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
898
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
899
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
900
+ "ssrf-meta-hardcoded:go-extended.js:39",
901
+ "ssrf-meta-hardcoded:python-sinks.js:186",
902
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
903
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
904
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
905
+ "zip-slip:zip-slip.js:192:node-entry"
906
+ ]
907
+ },
908
+ {
909
+ "timestamp": "2026-05-29T17:04:08.176Z",
910
+ "label": "scan",
911
+ "total": 21,
912
+ "critical": 0,
913
+ "high": 0,
914
+ "medium": 2,
915
+ "low": 19,
387
916
  "kev": 0,
388
917
  "ids": [
389
918
  "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
919
+ "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
920
+ "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
390
921
  "client-side:CLIENT_EVAL:client-side.js:135",
391
922
  "client-side:CLIENT_EVAL:client-side.js:139",
392
923
  "client-side:CLIENT_EVAL:client-side.js:140",
@@ -394,6 +925,8 @@
394
925
  "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
395
926
  "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
396
927
  "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
928
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
929
+ "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
397
930
  "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
398
931
  "spec-drift:rate-limit-impl:rate-limit.js:34",
399
932
  "spec-drift:rate-limit-impl:rate-limit.js:77",