@clear-capabilities/agentic-security-scanner 0.79.0 → 0.80.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (91) hide show
  1. package/dist/178.index.js +1 -1
  2. package/dist/333.index.js +283 -0
  3. package/dist/384.index.js +1 -1
  4. package/dist/637.index.js +1 -1
  5. package/dist/838.index.js +1 -1
  6. package/dist/985.index.js +90 -1
  7. package/dist/agentic-security.mjs +83 -83
  8. package/dist/agentic-security.mjs.sha256 +1 -1
  9. package/package.json +6 -4
  10. package/src/.agentic-security/findings.json +104638 -0
  11. package/src/.agentic-security/last-scan.json +104638 -0
  12. package/src/.agentic-security/last-scan.json.sig +1 -0
  13. package/src/.agentic-security/scan-history.json +12562 -0
  14. package/src/.agentic-security/streak.json +21 -0
  15. package/src/dataflow/.agentic-security/findings.json +6086 -0
  16. package/src/dataflow/.agentic-security/last-scan.json +6086 -0
  17. package/src/dataflow/.agentic-security/last-scan.json.sig +1 -0
  18. package/src/dataflow/.agentic-security/scan-history.json +250 -0
  19. package/src/dataflow/.agentic-security/streak.json +21 -0
  20. package/src/dataflow/cross-service-taint.js +201 -0
  21. package/src/dataflow/formal-verify.js +204 -0
  22. package/src/dataflow/ifds-precise.js +222 -0
  23. package/src/dataflow/k2-summary-cache.js +153 -0
  24. package/src/dataflow/lib-taint-summaries.js +198 -0
  25. package/src/dataflow/privacy-taint.js +205 -0
  26. package/src/dataflow/smt-feasibility.js +189 -0
  27. package/src/engine.js +784 -127
  28. package/src/ir/.agentic-security/findings.json +4011 -0
  29. package/src/ir/.agentic-security/last-scan.json +4011 -0
  30. package/src/ir/.agentic-security/last-scan.json.sig +1 -0
  31. package/src/ir/.agentic-security/scan-history.json +193 -0
  32. package/src/ir/.agentic-security/streak.json +20 -0
  33. package/src/ir/cpp-preprocessor.js +142 -0
  34. package/src/ir/csharp-ir.js +604 -0
  35. package/src/ir/universal-ir.js +403 -0
  36. package/src/mcp/.agentic-security/findings.json +8632 -0
  37. package/src/mcp/.agentic-security/last-scan.json +8632 -0
  38. package/src/mcp/.agentic-security/last-scan.json.sig +1 -0
  39. package/src/mcp/.agentic-security/scan-history.json +143 -0
  40. package/src/mcp/.agentic-security/streak.json +20 -0
  41. package/src/mcp/tools.js +90 -1
  42. package/src/posture/.agentic-security/findings.json +64004 -0
  43. package/src/posture/.agentic-security/last-scan.json +64004 -0
  44. package/src/posture/.agentic-security/last-scan.json.sig +1 -0
  45. package/src/posture/.agentic-security/scan-history.json +7162 -0
  46. package/src/posture/.agentic-security/streak.json +21 -0
  47. package/src/posture/api-contract.js +193 -0
  48. package/src/posture/attack-taxonomy.js +227 -0
  49. package/src/posture/compliance-policy.js +218 -0
  50. package/src/posture/composite-risk.js +122 -0
  51. package/src/posture/csharp-analysis.js +330 -0
  52. package/src/posture/exploit-bundle.js +210 -0
  53. package/src/posture/federated-learning.js +172 -0
  54. package/src/posture/license-attributions.js +94 -0
  55. package/src/posture/license-graph.js +238 -0
  56. package/src/posture/pqc-migration-plan.js +158 -0
  57. package/src/posture/reachability-filter.js +33 -2
  58. package/src/posture/realtime-cve-monitor.js +214 -0
  59. package/src/posture/runtime-correlation.js +174 -0
  60. package/src/posture/sbom-diff.js +171 -0
  61. package/src/posture/sca-policy.js +235 -0
  62. package/src/posture/sca-upgrade.js +259 -0
  63. package/src/posture/threat-model-auto.js +268 -0
  64. package/src/posture/triage-learning.js +170 -0
  65. package/src/posture/triage.js +26 -1
  66. package/src/sast/.agentic-security/findings.json +6154 -0
  67. package/src/sast/.agentic-security/last-scan.json +6154 -0
  68. package/src/sast/.agentic-security/last-scan.json.sig +1 -0
  69. package/src/sast/.agentic-security/scan-history.json +941 -0
  70. package/src/sast/.agentic-security/streak.json +22 -0
  71. package/src/sast/_secret-entropy.js +145 -0
  72. package/src/sast/cloud-iam.js +312 -0
  73. package/src/sast/cpp.js +138 -4
  74. package/src/sast/crypto-protocol.js +388 -0
  75. package/src/sast/csharp-tokenizer.js +392 -0
  76. package/src/sast/csharp.js +924 -138
  77. package/src/sast/dapp-frontend.js +200 -0
  78. package/src/sast/k8s-admission.js +271 -0
  79. package/src/sast/llm-app.js +272 -0
  80. package/src/sast/ml-supply-chain.js +259 -0
  81. package/src/sast/mobile.js +224 -0
  82. package/src/sast/post-quantum-crypto.js +348 -0
  83. package/src/sast/web3-advanced.js +375 -0
  84. package/src/sca/.agentic-security/findings.json +7460 -0
  85. package/src/sca/.agentic-security/last-scan.json +7460 -0
  86. package/src/sca/.agentic-security/last-scan.json.sig +1 -0
  87. package/src/sca/.agentic-security/scan-history.json +113 -0
  88. package/src/sca/.agentic-security/streak.json +21 -0
  89. package/src/sca/CLAUDE.md +161 -0
  90. package/src/sca/binary-metadata.js +37 -15
  91. package/src/sca/sigstore-verify.js +215 -0
package/src/sast/.agentic-security/scan-history.json ADDED
@@ -0,0 +1,941 @@
1
+ [
2
+ {
3
+ "timestamp": "2026-05-28T21:53:59.953Z",
4
+ "label": "scan",
5
+ "total": 17,
6
+ "critical": 0,
7
+ "high": 0,
8
+ "medium": 2,
9
+ "low": 15,
10
+ "kev": 0,
11
+ "ids": [
12
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
13
+ "client-side:CLIENT_EVAL:client-side.js:135",
14
+ "client-side:CLIENT_EVAL:client-side.js:139",
15
+ "client-side:CLIENT_EVAL:client-side.js:140",
16
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
17
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
18
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
19
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
20
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
21
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
22
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
23
+ "ssrf-meta-hardcoded:go-extended.js:39",
24
+ "ssrf-meta-hardcoded:python-sinks.js:186",
25
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
26
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
27
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
28
+ "zip-slip:zip-slip.js:192:node-entry"
29
+ ]
30
+ },
31
+ {
32
+ "timestamp": "2026-05-28T21:55:15.110Z",
33
+ "label": "scan",
34
+ "total": 17,
35
+ "critical": 0,
36
+ "high": 0,
37
+ "medium": 2,
38
+ "low": 15,
39
+ "kev": 0,
40
+ "ids": [
41
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
42
+ "client-side:CLIENT_EVAL:client-side.js:135",
43
+ "client-side:CLIENT_EVAL:client-side.js:139",
44
+ "client-side:CLIENT_EVAL:client-side.js:140",
45
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
46
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
47
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
48
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
49
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
50
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
51
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
52
+ "ssrf-meta-hardcoded:go-extended.js:39",
53
+ "ssrf-meta-hardcoded:python-sinks.js:186",
54
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
55
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
56
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
57
+ "zip-slip:zip-slip.js:192:node-entry"
58
+ ]
59
+ },
60
+ {
61
+ "timestamp": "2026-05-28T21:55:49.362Z",
62
+ "label": "scan",
63
+ "total": 17,
64
+ "critical": 0,
65
+ "high": 0,
66
+ "medium": 2,
67
+ "low": 15,
68
+ "kev": 0,
69
+ "ids": [
70
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
71
+ "client-side:CLIENT_EVAL:client-side.js:135",
72
+ "client-side:CLIENT_EVAL:client-side.js:139",
73
+ "client-side:CLIENT_EVAL:client-side.js:140",
74
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
75
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
76
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
77
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
78
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
79
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
80
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
81
+ "ssrf-meta-hardcoded:go-extended.js:39",
82
+ "ssrf-meta-hardcoded:python-sinks.js:186",
83
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
84
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
85
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
86
+ "zip-slip:zip-slip.js:192:node-entry"
87
+ ]
88
+ },
89
+ {
90
+ "timestamp": "2026-05-28T21:56:14.244Z",
91
+ "label": "scan",
92
+ "total": 17,
93
+ "critical": 0,
94
+ "high": 0,
95
+ "medium": 2,
96
+ "low": 15,
97
+ "kev": 0,
98
+ "ids": [
99
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
100
+ "client-side:CLIENT_EVAL:client-side.js:135",
101
+ "client-side:CLIENT_EVAL:client-side.js:139",
102
+ "client-side:CLIENT_EVAL:client-side.js:140",
103
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
104
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
105
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
106
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
107
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
108
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
109
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
110
+ "ssrf-meta-hardcoded:go-extended.js:39",
111
+ "ssrf-meta-hardcoded:python-sinks.js:186",
112
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
113
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
114
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
115
+ "zip-slip:zip-slip.js:192:node-entry"
116
+ ]
117
+ },
118
+ {
119
+ "timestamp": "2026-05-28T21:56:19.253Z",
120
+ "label": "scan",
121
+ "total": 17,
122
+ "critical": 0,
123
+ "high": 0,
124
+ "medium": 2,
125
+ "low": 15,
126
+ "kev": 0,
127
+ "ids": [
128
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
129
+ "client-side:CLIENT_EVAL:client-side.js:135",
130
+ "client-side:CLIENT_EVAL:client-side.js:139",
131
+ "client-side:CLIENT_EVAL:client-side.js:140",
132
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
133
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
134
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
135
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
136
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
137
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
138
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
139
+ "ssrf-meta-hardcoded:go-extended.js:39",
140
+ "ssrf-meta-hardcoded:python-sinks.js:186",
141
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
142
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
143
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
144
+ "zip-slip:zip-slip.js:192:node-entry"
145
+ ]
146
+ },
147
+ {
148
+ "timestamp": "2026-05-29T06:46:02.197Z",
149
+ "label": "scan",
150
+ "total": 18,
151
+ "critical": 0,
152
+ "high": 0,
153
+ "medium": 2,
154
+ "low": 16,
155
+ "kev": 0,
156
+ "ids": [
157
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
158
+ "client-side:CLIENT_EVAL:client-side.js:135",
159
+ "client-side:CLIENT_EVAL:client-side.js:139",
160
+ "client-side:CLIENT_EVAL:client-side.js:140",
161
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
162
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
163
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
164
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
165
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
166
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
167
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
168
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
169
+ "ssrf-meta-hardcoded:go-extended.js:39",
170
+ "ssrf-meta-hardcoded:python-sinks.js:186",
171
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
172
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
173
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
174
+ "zip-slip:zip-slip.js:192:node-entry"
175
+ ]
176
+ },
177
+ {
178
+ "timestamp": "2026-05-29T06:48:50.278Z",
179
+ "label": "scan",
180
+ "total": 18,
181
+ "critical": 0,
182
+ "high": 0,
183
+ "medium": 2,
184
+ "low": 16,
185
+ "kev": 0,
186
+ "ids": [
187
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
188
+ "client-side:CLIENT_EVAL:client-side.js:135",
189
+ "client-side:CLIENT_EVAL:client-side.js:139",
190
+ "client-side:CLIENT_EVAL:client-side.js:140",
191
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
192
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
193
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
194
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
195
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
196
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
197
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
198
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
199
+ "ssrf-meta-hardcoded:go-extended.js:39",
200
+ "ssrf-meta-hardcoded:python-sinks.js:186",
201
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
202
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
203
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
204
+ "zip-slip:zip-slip.js:192:node-entry"
205
+ ]
206
+ },
207
+ {
208
+ "timestamp": "2026-05-29T14:13:35.120Z",
209
+ "label": "scan",
210
+ "total": 18,
211
+ "critical": 0,
212
+ "high": 0,
213
+ "medium": 2,
214
+ "low": 16,
215
+ "kev": 0,
216
+ "ids": [
217
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
218
+ "client-side:CLIENT_EVAL:client-side.js:135",
219
+ "client-side:CLIENT_EVAL:client-side.js:139",
220
+ "client-side:CLIENT_EVAL:client-side.js:140",
221
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
222
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
223
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
224
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
225
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
226
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
227
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
228
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
229
+ "ssrf-meta-hardcoded:go-extended.js:39",
230
+ "ssrf-meta-hardcoded:python-sinks.js:186",
231
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
232
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
233
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
234
+ "zip-slip:zip-slip.js:192:node-entry"
235
+ ]
236
+ },
237
+ {
238
+ "timestamp": "2026-05-29T14:26:21.588Z",
239
+ "label": "scan",
240
+ "total": 18,
241
+ "critical": 0,
242
+ "high": 0,
243
+ "medium": 2,
244
+ "low": 16,
245
+ "kev": 0,
246
+ "ids": [
247
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
248
+ "client-side:CLIENT_EVAL:client-side.js:135",
249
+ "client-side:CLIENT_EVAL:client-side.js:139",
250
+ "client-side:CLIENT_EVAL:client-side.js:140",
251
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
252
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
253
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
254
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
255
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
256
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
257
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
258
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
259
+ "ssrf-meta-hardcoded:go-extended.js:39",
260
+ "ssrf-meta-hardcoded:python-sinks.js:186",
261
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
262
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
263
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
264
+ "zip-slip:zip-slip.js:192:node-entry"
265
+ ]
266
+ },
267
+ {
268
+ "timestamp": "2026-05-29T14:27:33.225Z",
269
+ "label": "scan",
270
+ "total": 18,
271
+ "critical": 0,
272
+ "high": 0,
273
+ "medium": 2,
274
+ "low": 16,
275
+ "kev": 0,
276
+ "ids": [
277
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
278
+ "client-side:CLIENT_EVAL:client-side.js:135",
279
+ "client-side:CLIENT_EVAL:client-side.js:139",
280
+ "client-side:CLIENT_EVAL:client-side.js:140",
281
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
282
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
283
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
284
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
285
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
286
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
287
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
288
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
289
+ "ssrf-meta-hardcoded:go-extended.js:39",
290
+ "ssrf-meta-hardcoded:python-sinks.js:186",
291
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
292
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
293
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
294
+ "zip-slip:zip-slip.js:192:node-entry"
295
+ ]
296
+ },
297
+ {
298
+ "timestamp": "2026-05-29T14:30:05.515Z",
299
+ "label": "scan",
300
+ "total": 18,
301
+ "critical": 0,
302
+ "high": 0,
303
+ "medium": 2,
304
+ "low": 16,
305
+ "kev": 0,
306
+ "ids": [
307
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
308
+ "client-side:CLIENT_EVAL:client-side.js:135",
309
+ "client-side:CLIENT_EVAL:client-side.js:139",
310
+ "client-side:CLIENT_EVAL:client-side.js:140",
311
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
312
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
313
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
314
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
315
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
316
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
317
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
318
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
319
+ "ssrf-meta-hardcoded:go-extended.js:39",
320
+ "ssrf-meta-hardcoded:python-sinks.js:186",
321
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
322
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
323
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
324
+ "zip-slip:zip-slip.js:192:node-entry"
325
+ ]
326
+ },
327
+ {
328
+ "timestamp": "2026-05-29T15:08:40.086Z",
329
+ "label": "scan",
330
+ "total": 18,
331
+ "critical": 0,
332
+ "high": 0,
333
+ "medium": 2,
334
+ "low": 16,
335
+ "kev": 0,
336
+ "ids": [
337
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
338
+ "client-side:CLIENT_EVAL:client-side.js:135",
339
+ "client-side:CLIENT_EVAL:client-side.js:139",
340
+ "client-side:CLIENT_EVAL:client-side.js:140",
341
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
342
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
343
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
344
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
345
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
346
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
347
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
348
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
349
+ "ssrf-meta-hardcoded:go-extended.js:39",
350
+ "ssrf-meta-hardcoded:python-sinks.js:186",
351
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
352
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
353
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
354
+ "zip-slip:zip-slip.js:192:node-entry"
355
+ ]
356
+ },
357
+ {
358
+ "timestamp": "2026-05-29T15:10:05.268Z",
359
+ "label": "scan",
360
+ "total": 19,
361
+ "critical": 0,
362
+ "high": 0,
363
+ "medium": 2,
364
+ "low": 17,
365
+ "kev": 0,
366
+ "ids": [
367
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
368
+ "client-side:CLIENT_EVAL:client-side.js:135",
369
+ "client-side:CLIENT_EVAL:client-side.js:139",
370
+ "client-side:CLIENT_EVAL:client-side.js:140",
371
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
372
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
373
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
374
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
375
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
376
+ "prompt-tpl:k8s-admission.js:140:Prompt_Template__user_input_interpolated_into_prompt_string_",
377
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
378
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
379
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
380
+ "ssrf-meta-hardcoded:go-extended.js:39",
381
+ "ssrf-meta-hardcoded:python-sinks.js:186",
382
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
383
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
384
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
385
+ "zip-slip:zip-slip.js:192:node-entry"
386
+ ]
387
+ },
388
+ {
389
+ "timestamp": "2026-05-29T15:12:36.888Z",
390
+ "label": "scan",
391
+ "total": 19,
392
+ "critical": 0,
393
+ "high": 0,
394
+ "medium": 2,
395
+ "low": 17,
396
+ "kev": 0,
397
+ "ids": [
398
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
399
+ "client-side:CLIENT_EVAL:client-side.js:135",
400
+ "client-side:CLIENT_EVAL:client-side.js:139",
401
+ "client-side:CLIENT_EVAL:client-side.js:140",
402
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
403
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
404
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
405
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
406
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
407
+ "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
408
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
409
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
410
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
411
+ "ssrf-meta-hardcoded:go-extended.js:39",
412
+ "ssrf-meta-hardcoded:python-sinks.js:186",
413
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
414
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
415
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
416
+ "zip-slip:zip-slip.js:192:node-entry"
417
+ ]
418
+ },
419
+ {
420
+ "timestamp": "2026-05-29T15:12:45.140Z",
421
+ "label": "scan",
422
+ "total": 19,
423
+ "critical": 0,
424
+ "high": 0,
425
+ "medium": 2,
426
+ "low": 17,
427
+ "kev": 0,
428
+ "ids": [
429
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
430
+ "client-side:CLIENT_EVAL:client-side.js:135",
431
+ "client-side:CLIENT_EVAL:client-side.js:139",
432
+ "client-side:CLIENT_EVAL:client-side.js:140",
433
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
434
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
435
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
436
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
437
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
438
+ "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
439
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
440
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
441
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
442
+ "ssrf-meta-hardcoded:go-extended.js:39",
443
+ "ssrf-meta-hardcoded:python-sinks.js:186",
444
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
445
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
446
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
447
+ "zip-slip:zip-slip.js:192:node-entry"
448
+ ]
449
+ },
450
+ {
451
+ "timestamp": "2026-05-29T15:12:52.802Z",
452
+ "label": "scan",
453
+ "total": 19,
454
+ "critical": 0,
455
+ "high": 0,
456
+ "medium": 2,
457
+ "low": 17,
458
+ "kev": 0,
459
+ "ids": [
460
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
461
+ "client-side:CLIENT_EVAL:client-side.js:135",
462
+ "client-side:CLIENT_EVAL:client-side.js:139",
463
+ "client-side:CLIENT_EVAL:client-side.js:140",
464
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
465
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
466
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
467
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
468
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
469
+ "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
470
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
471
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
472
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
473
+ "ssrf-meta-hardcoded:go-extended.js:39",
474
+ "ssrf-meta-hardcoded:python-sinks.js:186",
475
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
476
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
477
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
478
+ "zip-slip:zip-slip.js:192:node-entry"
479
+ ]
480
+ },
481
+ {
482
+ "timestamp": "2026-05-29T15:13:01.692Z",
483
+ "label": "scan",
484
+ "total": 19,
485
+ "critical": 0,
486
+ "high": 0,
487
+ "medium": 2,
488
+ "low": 17,
489
+ "kev": 0,
490
+ "ids": [
491
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
492
+ "client-side:CLIENT_EVAL:client-side.js:135",
493
+ "client-side:CLIENT_EVAL:client-side.js:139",
494
+ "client-side:CLIENT_EVAL:client-side.js:140",
495
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
496
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
497
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
498
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
499
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
500
+ "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
501
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
502
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
503
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
504
+ "ssrf-meta-hardcoded:go-extended.js:39",
505
+ "ssrf-meta-hardcoded:python-sinks.js:186",
506
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
507
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
508
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
509
+ "zip-slip:zip-slip.js:192:node-entry"
510
+ ]
511
+ },
512
+ {
513
+ "timestamp": "2026-05-29T16:09:42.230Z",
514
+ "label": "scan",
515
+ "total": 21,
516
+ "critical": 0,
517
+ "high": 0,
518
+ "medium": 2,
519
+ "low": 19,
520
+ "kev": 0,
521
+ "ids": [
522
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
523
+ "authz:crypto-protocol.js:329:AuthZ__jwt_verify_called_without_algorithms_allow_list",
524
+ "authz:crypto-protocol.js:330:AuthZ__jwt_verify_called_without_algorithms_allow_list",
525
+ "client-side:CLIENT_EVAL:client-side.js:135",
526
+ "client-side:CLIENT_EVAL:client-side.js:139",
527
+ "client-side:CLIENT_EVAL:client-side.js:140",
528
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
529
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
530
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
531
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
532
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
533
+ "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
534
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
535
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
536
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
537
+ "ssrf-meta-hardcoded:go-extended.js:39",
538
+ "ssrf-meta-hardcoded:python-sinks.js:186",
539
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
540
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
541
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
542
+ "zip-slip:zip-slip.js:192:node-entry"
543
+ ]
544
+ },
545
+ {
546
+ "timestamp": "2026-05-29T16:12:29.038Z",
547
+ "label": "scan",
548
+ "total": 21,
549
+ "critical": 0,
550
+ "high": 0,
551
+ "medium": 2,
552
+ "low": 19,
553
+ "kev": 0,
554
+ "ids": [
555
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
556
+ "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
557
+ "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
558
+ "client-side:CLIENT_EVAL:client-side.js:135",
559
+ "client-side:CLIENT_EVAL:client-side.js:139",
560
+ "client-side:CLIENT_EVAL:client-side.js:140",
561
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
562
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
563
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
564
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
565
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
566
+ "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
567
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
568
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
569
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
570
+ "ssrf-meta-hardcoded:go-extended.js:39",
571
+ "ssrf-meta-hardcoded:python-sinks.js:186",
572
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
573
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
574
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
575
+ "zip-slip:zip-slip.js:192:node-entry"
576
+ ]
577
+ },
578
+ {
579
+ "timestamp": "2026-05-29T16:13:59.607Z",
580
+ "label": "scan",
581
+ "total": 21,
582
+ "critical": 0,
583
+ "high": 0,
584
+ "medium": 2,
585
+ "low": 19,
586
+ "kev": 0,
587
+ "ids": [
588
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
589
+ "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
590
+ "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
591
+ "client-side:CLIENT_EVAL:client-side.js:135",
592
+ "client-side:CLIENT_EVAL:client-side.js:139",
593
+ "client-side:CLIENT_EVAL:client-side.js:140",
594
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
595
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
596
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
597
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
598
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
599
+ "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
600
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
601
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
602
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
603
+ "ssrf-meta-hardcoded:go-extended.js:39",
604
+ "ssrf-meta-hardcoded:python-sinks.js:186",
605
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
606
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
607
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
608
+ "zip-slip:zip-slip.js:192:node-entry"
609
+ ]
610
+ },
611
+ {
612
+ "timestamp": "2026-05-29T16:32:06.484Z",
613
+ "label": "scan",
614
+ "total": 21,
615
+ "critical": 0,
616
+ "high": 0,
617
+ "medium": 2,
618
+ "low": 19,
619
+ "kev": 0,
620
+ "ids": [
621
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
622
+ "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
623
+ "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
624
+ "client-side:CLIENT_EVAL:client-side.js:135",
625
+ "client-side:CLIENT_EVAL:client-side.js:139",
626
+ "client-side:CLIENT_EVAL:client-side.js:140",
627
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
628
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
629
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
630
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
631
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
632
+ "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
633
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
634
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
635
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
636
+ "ssrf-meta-hardcoded:go-extended.js:39",
637
+ "ssrf-meta-hardcoded:python-sinks.js:186",
638
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
639
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
640
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
641
+ "zip-slip:zip-slip.js:192:node-entry"
642
+ ]
643
+ },
644
+ {
645
+ "timestamp": "2026-05-29T16:33:51.164Z",
646
+ "label": "scan",
647
+ "total": 21,
648
+ "critical": 0,
649
+ "high": 0,
650
+ "medium": 2,
651
+ "low": 19,
652
+ "kev": 0,
653
+ "ids": [
654
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
655
+ "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
656
+ "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
657
+ "client-side:CLIENT_EVAL:client-side.js:135",
658
+ "client-side:CLIENT_EVAL:client-side.js:139",
659
+ "client-side:CLIENT_EVAL:client-side.js:140",
660
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
661
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
662
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
663
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
664
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
665
+ "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
666
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
667
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
668
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
669
+ "ssrf-meta-hardcoded:go-extended.js:39",
670
+ "ssrf-meta-hardcoded:python-sinks.js:186",
671
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
672
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
673
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
674
+ "zip-slip:zip-slip.js:192:node-entry"
675
+ ]
676
+ },
677
+ {
678
+ "timestamp": "2026-05-29T17:02:03.828Z",
679
+ "label": "scan",
680
+ "total": 21,
681
+ "critical": 0,
682
+ "high": 0,
683
+ "medium": 2,
684
+ "low": 19,
685
+ "kev": 0,
686
+ "ids": [
687
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
688
+ "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
689
+ "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
690
+ "client-side:CLIENT_EVAL:client-side.js:135",
691
+ "client-side:CLIENT_EVAL:client-side.js:139",
692
+ "client-side:CLIENT_EVAL:client-side.js:140",
693
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
694
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
695
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
696
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
697
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
698
+ "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
699
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
700
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
701
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
702
+ "ssrf-meta-hardcoded:go-extended.js:39",
703
+ "ssrf-meta-hardcoded:python-sinks.js:186",
704
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
705
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
706
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
707
+ "zip-slip:zip-slip.js:192:node-entry"
708
+ ]
709
+ },
710
+ {
711
+ "timestamp": "2026-05-29T17:02:12.361Z",
712
+ "label": "scan",
713
+ "total": 21,
714
+ "critical": 0,
715
+ "high": 0,
716
+ "medium": 2,
717
+ "low": 19,
718
+ "kev": 0,
719
+ "ids": [
720
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
721
+ "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
722
+ "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
723
+ "client-side:CLIENT_EVAL:client-side.js:135",
724
+ "client-side:CLIENT_EVAL:client-side.js:139",
725
+ "client-side:CLIENT_EVAL:client-side.js:140",
726
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
727
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
728
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
729
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
730
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
731
+ "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
732
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
733
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
734
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
735
+ "ssrf-meta-hardcoded:go-extended.js:39",
736
+ "ssrf-meta-hardcoded:python-sinks.js:186",
737
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
738
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
739
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
740
+ "zip-slip:zip-slip.js:192:node-entry"
741
+ ]
742
+ },
743
+ {
744
+ "timestamp": "2026-05-29T17:02:20.453Z",
745
+ "label": "scan",
746
+ "total": 21,
747
+ "critical": 0,
748
+ "high": 0,
749
+ "medium": 2,
750
+ "low": 19,
751
+ "kev": 0,
752
+ "ids": [
753
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
754
+ "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
755
+ "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
756
+ "client-side:CLIENT_EVAL:client-side.js:135",
757
+ "client-side:CLIENT_EVAL:client-side.js:139",
758
+ "client-side:CLIENT_EVAL:client-side.js:140",
759
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
760
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
761
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
762
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
763
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
764
+ "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
765
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
766
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
767
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
768
+ "ssrf-meta-hardcoded:go-extended.js:39",
769
+ "ssrf-meta-hardcoded:python-sinks.js:186",
770
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
771
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
772
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
773
+ "zip-slip:zip-slip.js:192:node-entry"
774
+ ]
775
+ },
776
+ {
777
+ "timestamp": "2026-05-29T17:03:04.332Z",
778
+ "label": "scan",
779
+ "total": 21,
780
+ "critical": 0,
781
+ "high": 0,
782
+ "medium": 2,
783
+ "low": 19,
784
+ "kev": 0,
785
+ "ids": [
786
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
787
+ "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
788
+ "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
789
+ "client-side:CLIENT_EVAL:client-side.js:135",
790
+ "client-side:CLIENT_EVAL:client-side.js:139",
791
+ "client-side:CLIENT_EVAL:client-side.js:140",
792
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
793
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
794
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
795
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
796
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
797
+ "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
798
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
799
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
800
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
801
+ "ssrf-meta-hardcoded:go-extended.js:39",
802
+ "ssrf-meta-hardcoded:python-sinks.js:186",
803
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
804
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
805
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
806
+ "zip-slip:zip-slip.js:192:node-entry"
807
+ ]
808
+ },
809
+ {
810
+ "timestamp": "2026-05-29T17:03:11.818Z",
811
+ "label": "scan",
812
+ "total": 21,
813
+ "critical": 0,
814
+ "high": 0,
815
+ "medium": 2,
816
+ "low": 19,
817
+ "kev": 0,
818
+ "ids": [
819
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
820
+ "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
821
+ "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
822
+ "client-side:CLIENT_EVAL:client-side.js:135",
823
+ "client-side:CLIENT_EVAL:client-side.js:139",
824
+ "client-side:CLIENT_EVAL:client-side.js:140",
825
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
826
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
827
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
828
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
829
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
830
+ "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
831
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
832
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
833
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
834
+ "ssrf-meta-hardcoded:go-extended.js:39",
835
+ "ssrf-meta-hardcoded:python-sinks.js:186",
836
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
837
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
838
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
839
+ "zip-slip:zip-slip.js:192:node-entry"
840
+ ]
841
+ },
842
+ {
843
+ "timestamp": "2026-05-29T17:03:19.497Z",
844
+ "label": "scan",
845
+ "total": 21,
846
+ "critical": 0,
847
+ "high": 0,
848
+ "medium": 2,
849
+ "low": 19,
850
+ "kev": 0,
851
+ "ids": [
852
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
853
+ "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
854
+ "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
855
+ "client-side:CLIENT_EVAL:client-side.js:135",
856
+ "client-side:CLIENT_EVAL:client-side.js:139",
857
+ "client-side:CLIENT_EVAL:client-side.js:140",
858
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
859
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
860
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
861
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
862
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
863
+ "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
864
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
865
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
866
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
867
+ "ssrf-meta-hardcoded:go-extended.js:39",
868
+ "ssrf-meta-hardcoded:python-sinks.js:186",
869
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
870
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
871
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
872
+ "zip-slip:zip-slip.js:192:node-entry"
873
+ ]
874
+ },
875
+ {
876
+ "timestamp": "2026-05-29T17:04:00.294Z",
877
+ "label": "scan",
878
+ "total": 21,
879
+ "critical": 0,
880
+ "high": 0,
881
+ "medium": 2,
882
+ "low": 19,
883
+ "kev": 0,
884
+ "ids": [
885
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
886
+ "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
887
+ "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
888
+ "client-side:CLIENT_EVAL:client-side.js:135",
889
+ "client-side:CLIENT_EVAL:client-side.js:139",
890
+ "client-side:CLIENT_EVAL:client-side.js:140",
891
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
892
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
893
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
894
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
895
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
896
+ "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
897
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
898
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
899
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
900
+ "ssrf-meta-hardcoded:go-extended.js:39",
901
+ "ssrf-meta-hardcoded:python-sinks.js:186",
902
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
903
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
904
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
905
+ "zip-slip:zip-slip.js:192:node-entry"
906
+ ]
907
+ },
908
+ {
909
+ "timestamp": "2026-05-29T17:04:08.176Z",
910
+ "label": "scan",
911
+ "total": 21,
912
+ "critical": 0,
913
+ "high": 0,
914
+ "medium": 2,
915
+ "low": 19,
916
+ "kev": 0,
917
+ "ids": [
918
+ "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
919
+ "authz:crypto-protocol.js:332:AuthZ__jwt_verify_called_without_algorithms_allow_list",
920
+ "authz:crypto-protocol.js:333:AuthZ__jwt_verify_called_without_algorithms_allow_list",
921
+ "client-side:CLIENT_EVAL:client-side.js:135",
922
+ "client-side:CLIENT_EVAL:client-side.js:139",
923
+ "client-side:CLIENT_EVAL:client-side.js:140",
924
+ "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
925
+ "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
926
+ "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
927
+ "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
928
+ "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
929
+ "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
930
+ "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
931
+ "spec-drift:rate-limit-impl:rate-limit.js:34",
932
+ "spec-drift:rate-limit-impl:rate-limit.js:77",
933
+ "ssrf-meta-hardcoded:go-extended.js:39",
934
+ "ssrf-meta-hardcoded:python-sinks.js:186",
935
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
936
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:48",
937
+ "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:73",
938
+ "zip-slip:zip-slip.js:192:node-entry"
939
+ ]
940
+ }
941
+ ]