@clear-capabilities/agentic-security-scanner 0.84.1 → 0.118.2

package/src/sast/.agentic-security/threat-model.json

@@ -0,0 +1,816 @@
+{
+  "entities": [
+    {
+      "kind": "http-route",
+      "id": "route:GET:                                                                                                                                  \n      parser: ",
+      "method": "GET",
+      "path": "                                                                                                                                  \n      parser: ",
+      "file": "xpath-injection.js",
+      "line": 69,
+      "requiresAuth": false
+    },
+    {
+      "kind": "queue-consumer",
+      "id": "queue:sensitive-data-logging.js:67",
+      "file": "sensitive-data-logging.js",
+      "line": 67
+    }
+  ],
+  "boundaries": [
+    {
+      "from": "external",
+      "to": "route:GET:                                                                                                                                  \n      parser: ",
+      "kind": "trust-boundary",
+      "requiresAuth": false
+    },
+    {
+      "from": "external",
+      "to": "queue:sensitive-data-logging.js:67",
+      "kind": "trust-boundary"
+    }
+  ],
+  "assets": [],
+  "threats": [
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-295",
+      "family": "crypto-tls-no-verify",
+      "severity": "medium",
+      "file": "crypto-protocol.js",
+      "line": 105,
+      "vuln": "TLS certificate verification disabled — MITM-vulnerable",
+      "finding_id": "crypto-tls-no-verify:crypto-protocol.js:105",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-295",
+      "family": "crypto-tls-no-verify",
+      "severity": "medium",
+      "file": "crypto-protocol.js",
+      "line": 108,
+      "vuln": "TLS certificate verification disabled — MITM-vulnerable",
+      "finding_id": "crypto-tls-no-verify:crypto-protocol.js:108",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-295",
+      "family": "crypto-tls-no-verify",
+      "severity": "medium",
+      "file": "crypto-protocol.js",
+      "line": 114,
+      "vuln": "TLS certificate verification disabled — MITM-vulnerable",
+      "finding_id": "crypto-tls-no-verify:crypto-protocol.js:114",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-295",
+      "family": "crypto-tls-no-verify",
+      "severity": "medium",
+      "file": "crypto-protocol.js",
+      "line": 116,
+      "vuln": "TLS certificate verification disabled — MITM-vulnerable",
+      "finding_id": "crypto-tls-no-verify:crypto-protocol.js:116",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-295",
+      "family": "crypto-tls-no-verify",
+      "severity": "medium",
+      "file": "crypto-protocol.js",
+      "line": 118,
+      "vuln": "TLS certificate verification disabled — MITM-vulnerable",
+      "finding_id": "crypto-tls-no-verify:crypto-protocol.js:118",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-345",
+      "family": "eth-sign-used",
+      "severity": "medium",
+      "file": "dapp-frontend.js",
+      "line": 74,
+      "vuln": "eth_sign — signs arbitrary 32-byte hash with no prefix (the \"death sign\")",
+      "finding_id": "dapp-eth-sign:dapp-frontend.js:74",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-770",
+      "family": "spec-drift",
+      "severity": "medium",
+      "file": "rate-limit.js",
+      "line": 34,
+      "vuln": "Spec drift — _hasRateLimit() claims rate-limit-impl but body lacks expected evidence",
+      "finding_id": "spec-drift:rate-limit-impl:rate-limit.js:34",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-770",
+      "family": "spec-drift",
+      "severity": "medium",
+      "file": "rate-limit.js",
+      "line": 77,
+      "vuln": "Spec drift — scanRateLimit() claims rate-limit-impl but body lacks expected evidence",
+      "finding_id": "spec-drift:rate-limit-impl:rate-limit.js:77",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-347",
+      "family": "idor",
+      "severity": "low",
+      "file": "authz.js",
+      "line": 33,
+      "vuln": "AuthZ: jwt.verify called without algorithms allow-list",
+      "finding_id": "authz:authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-349",
+      "family": "cache-poisoning",
+      "severity": "low",
+      "file": "cache-poisoning.js",
+      "line": 20,
+      "vuln": "Cache Poisoning — X-Forwarded-Host reflected from request to response",
+      "finding_id": "cache-poison-reflect:cache-poisoning.js:20",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-95",
+      "family": "client-side-eval-with-dynamic-input",
+      "severity": "low",
+      "file": "client-side.js",
+      "line": 135,
+      "vuln": "Client-Side — eval with Dynamic Input",
+      "finding_id": "client-side:CLIENT_EVAL:client-side.js:135",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-95",
+      "family": "client-side-eval-with-dynamic-input",
+      "severity": "low",
+      "file": "client-side.js",
+      "line": 139,
+      "vuln": "Client-Side — eval with Dynamic Input",
+      "finding_id": "client-side:CLIENT_EVAL:client-side.js:139",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-95",
+      "family": "client-side-eval-with-dynamic-input",
+      "severity": "low",
+      "file": "client-side.js",
+      "line": 140,
+      "vuln": "Client-Side — eval with Dynamic Input",
+      "finding_id": "client-side:CLIENT_EVAL:client-side.js:140",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-347",
+      "family": "idor",
+      "severity": "low",
+      "file": "crypto-protocol.js",
+      "line": 374,
+      "vuln": "AuthZ: jwt.verify called without algorithms allow-list",
+      "finding_id": "authz:crypto-protocol.js:374:AuthZ__jwt_verify_called_without_algorithms_allow_list",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-347",
+      "family": "idor",
+      "severity": "low",
+      "file": "crypto-protocol.js",
+      "line": 375,
+      "vuln": "AuthZ: jwt.verify called without algorithms allow-list",
+      "finding_id": "authz:crypto-protocol.js:375:AuthZ__jwt_verify_called_without_algorithms_allow_list",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-326",
+      "family": "crypto-tls-version",
+      "severity": "low",
+      "file": "crypto-protocol.js",
+      "line": 67,
+      "vuln": "TLS configured to accept versions below TLS 1.2",
+      "finding_id": "crypto-tls-min-version:crypto-protocol.js:67",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-326",
+      "family": "crypto-tls-version",
+      "severity": "low",
+      "file": "crypto-protocol.js",
+      "line": 69,
+      "vuln": "TLS configured to accept versions below TLS 1.2",
+      "finding_id": "crypto-tls-min-version:crypto-protocol.js:69",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-327",
+      "family": "crypto-weak-cipher",
+      "severity": "low",
+      "file": "crypto-protocol.js",
+      "line": 141,
+      "vuln": "Weak symmetric cipher in use (DES / 3DES / RC4 / Blowfish / NULL / EXPORT)",
+      "finding_id": "crypto-weak-cipher:crypto-protocol.js:141",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-327",
+      "family": "crypto-weak-cipher",
+      "severity": "low",
+      "file": "crypto-protocol.js",
+      "line": 143,
+      "vuln": "Weak symmetric cipher in use (DES / 3DES / RC4 / Blowfish / NULL / EXPORT)",
+      "finding_id": "crypto-weak-cipher:crypto-protocol.js:143",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-327",
+      "family": "crypto-weak-cipher",
+      "severity": "low",
+      "file": "crypto-protocol.js",
+      "line": 145,
+      "vuln": "Weak symmetric cipher in use (DES / 3DES / RC4 / Blowfish / NULL / EXPORT)",
+      "finding_id": "crypto-weak-cipher:crypto-protocol.js:145",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-327",
+      "family": "crypto-weak-cipher",
+      "severity": "low",
+      "file": "crypto-protocol.js",
+      "line": 149,
+      "vuln": "Weak symmetric cipher in use (DES / 3DES / RC4 / Blowfish / NULL / EXPORT)",
+      "finding_id": "crypto-weak-cipher:crypto-protocol.js:149",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-345",
+      "family": "crypto-jwt-key-confusion",
+      "severity": "low",
+      "file": "crypto-protocol.js",
+      "line": 374,
+      "vuln": "jwt.verify called without algorithms allowlist — algorithm-confusion attack",
+      "finding_id": "crypto-jwt-no-algs-allowlist:crypto-protocol.js:374",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-1336",
+      "family": "prompt-template-user-input-interpolated-",
+      "severity": "low",
+      "file": "k8s-admission.js",
+      "line": 139,
+      "vuln": "Prompt Template: user input interpolated into prompt string without isolation",
+      "finding_id": "prompt-tpl:k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-1427",
+      "family": "llm-app-security",
+      "severity": "low",
+      "file": "llm-app.js",
+      "line": 93,
+      "vuln": "Prompt Injection — system prompt concatenated with user input",
+      "finding_id": "llm-prompt-injection-mix:93",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-1427",
+      "family": "llm-app-security",
+      "severity": "low",
+      "file": "llm-app.js",
+      "line": 136,
+      "vuln": "RAG Injection — vector-store result flows into LLM prompt without sanitization",
+      "finding_id": "llm-rag-injection:136",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-1427",
+      "family": "llm-app-security",
+      "severity": "low",
+      "file": "llm-app.js",
+      "line": 137,
+      "vuln": "RAG Injection — vector-store result flows into LLM prompt without sanitization",
+      "finding_id": "llm-rag-injection:137",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-502",
+      "family": "llm-app-security",
+      "severity": "low",
+      "file": "llm-app.js",
+      "line": 163,
+      "vuln": "Untrusted Model Load — model file loaded from a non-literal path",
+      "finding_id": "llm-model-load-untrusted:163",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-1427",
+      "family": "prompt-injection-system-prompt-built-fro",
+      "severity": "low",
+      "file": "llm-owasp.js",
+      "line": 180,
+      "vuln": "Prompt Injection — system prompt built from concatenated/interpolated content (LLM01)",
+      "finding_id": "llm-owasp:llm-owasp.js:180:llm01-dynamic-system:concat",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-1427",
+      "family": "prompt-injection-system-prompt-built-fro",
+      "severity": "low",
+      "file": "llm-owasp.js",
+      "line": 181,
+      "vuln": "Prompt Injection — system prompt built from concatenated/interpolated content (LLM01)",
+      "finding_id": "llm-owasp:llm-owasp.js:181:llm01-dynamic-system:fstring",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-1427",
+      "family": "prompt-injection-system-prompt-built-fro",
+      "severity": "low",
+      "file": "llm-owasp.js",
+      "line": 182,
+      "vuln": "Prompt Injection — system prompt built from concatenated/interpolated content (LLM01)",
+      "finding_id": "llm-owasp:llm-owasp.js:182:llm01-dynamic-system:template",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-1336",
+      "family": "prompt-template-user-input-interpolated-",
+      "severity": "low",
+      "file": "llm-owasp.js",
+      "line": 125,
+      "vuln": "Prompt Template: user input interpolated into prompt string without isolation",
+      "finding_id": "prompt-tpl:llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-502",
+      "family": "llm-app-security",
+      "severity": "low",
+      "file": "model-load.js",
+      "line": 45,
+      "vuln": "Untrusted Model Load — model file loaded from a non-literal path",
+      "finding_id": "llm-model-load-untrusted:45",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-79",
+      "family": "xss",
+      "severity": "low",
+      "file": "mutation-xss.js",
+      "line": 123,
+      "vuln": "Markdown→HTML XSS — user-supplied Markdown rendered to HTML without sanitization",
+      "finding_id": "markdown-xss:mutation-xss.js:123",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-327",
+      "family": "pqc-migration",
+      "severity": "low",
+      "file": "post-quantum-crypto.js",
+      "line": 136,
+      "vuln": "Pre-quantum RSA (rsa-encrypt) — replace with ML-KEM-768 before CRQC arrives",
+      "finding_id": "pqc-rsa-encrypt:post-quantum-crypto.js:136",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-22",
+      "family": "zip-slip",
+      "severity": "low",
+      "file": "zip-slip.js",
+      "line": 192,
+      "vuln": "Zip Slip: archive entry.path written to filesystem without sanitization",
+      "finding_id": "zip-slip:zip-slip.js:192:node-entry",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "csharp-structural.js",
+      "line": 60,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:csharp-structural.js:60",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "csharp-structural.js",
+      "line": 60,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:csharp-structural.js:60",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "go-extended.js",
+      "line": 39,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:go-extended.js:39",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "go-extended.js",
+      "line": 39,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:go-extended.js:39",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-644",
+      "family": "cache-poisoning",
+      "severity": "low",
+      "file": "host-header.js",
+      "line": 99,
+      "vuln": "Cache Poisoning — Host header used in URL/redirect generation",
+      "finding_id": "cache-poison-host:host-header.js:99",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "java-structural.js",
+      "line": 76,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:java-structural.js:76",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "java-structural.js",
+      "line": 76,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:java-structural.js:76",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "js-framework-structural.js",
+      "line": 69,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:js-framework-structural.js:69",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "js-framework-structural.js",
+      "line": 69,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:js-framework-structural.js:69",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "kotlin.js",
+      "line": 136,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:kotlin.js:136",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "kotlin.js",
+      "line": 136,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:kotlin.js:136",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-77",
+      "family": "system-prompt-missing-explicit-anti-inje",
+      "severity": "low",
+      "file": "llm-app.js",
+      "line": 104,
+      "vuln": "System prompt missing explicit anti-injection guidance — model may follow user-supplied \"ignore previous\" attacks",
+      "finding_id": "llm-redteam:noPromptInjectionDefense:llm-app.js:104",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "unbounded-consumption-llm-call-has-no-to",
+      "severity": "low",
+      "file": "llm-owasp.js",
+      "line": 183,
+      "vuln": "Unbounded Consumption — LLM call has no token budget (LLM10)",
+      "finding_id": "llm-owasp:llm-owasp.js:183:llm10-no-token-budget",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "php.js",
+      "line": 111,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:php.js:111",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "php.js",
+      "line": 111,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:php.js:111",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "python-sinks.js",
+      "line": 186,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:python-sinks.js:186",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "python-sinks.js",
+      "line": 186,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:python-sinks.js:186",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-532",
+      "family": "sensitive-data-logging",
+      "severity": "low",
+      "file": "sensitive-data-logging.js",
+      "line": 67,
+      "vuln": "Sensitive Data Logged — PII-named variable sent to logger without sanitization",
+      "finding_id": "sensitive-log:sensitive-data-logging.js:67",
+      "affectsAsset": null,
+      "atEntity": "queue:sensitive-data-logging.js:67"
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "ssrf-cloud-metadata.js",
+      "line": 61,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:61",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "ssrf-cloud-metadata.js",
+      "line": 61,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:61",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "ssrf-cloud-metadata.js",
+      "line": 86,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:86",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "ssrf-cloud-metadata.js",
+      "line": 86,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:86",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "ssrf-cloud-metadata.js",
+      "line": 15,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "ssrf-cloud-metadata.js",
+      "line": 15,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:ssrf-cloud-metadata.js:15",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-327",
+      "family": "crypto-weak-hash",
+      "severity": "low",
+      "file": "weak-password-hash.js",
+      "line": 45,
+      "vuln": "Weak hash algorithm (MD5 / SHA-1 / MD2 / MD4) used",
+      "finding_id": "crypto-weak-hash:weak-password-hash.js:45",
+      "affectsAsset": null,
+      "atEntity": null
+    }
+  ],
+  "attackTrees": []
+}