npm - @clear-capabilities/agentic-security-scanner - Versions diffs - 0.86.0 → 0.118.2 - Mend

@clear-capabilities/agentic-security-scanner 0.86.0 → 0.118.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (120) hide show

package/src/.agentic-security/threat-model.json ADDED Viewed

@@ -0,0 +1,3702 @@
+{
+  "entities": [
+    {
+      "kind": "http-route",
+      "id": "route:GET:/api/endpoint",
+      "method": "GET",
+      "path": "/api/endpoint",
+      "file": "poc-video.js",
+      "line": 56,
+      "requiresAuth": false
+    },
+    {
+      "kind": "http-route",
+      "id": "route:GET:/api/users/2",
+      "method": "GET",
+      "path": "/api/users/2",
+      "file": "posture/attack-playbooks.js",
+      "line": 92,
+      "requiresAuth": false
+    },
+    {
+      "kind": "http-route",
+      "id": "route:GET:/api/admin/users",
+      "method": "GET",
+      "path": "/api/admin/users",
+      "file": "posture/attack-playbooks.js",
+      "line": 210,
+      "requiresAuth": false
+    },
+    {
+      "kind": "http-route",
+      "id": "route:GET:/api/health",
+      "method": "GET",
+      "path": "/api/health",
+      "file": "posture/deploy-platform.js",
+      "line": 87,
+      "requiresAuth": false
+    },
+    {
+      "kind": "http-route",
+      "id": "route:GET:                                                                                                                                  \n      parser: ",
+      "method": "GET",
+      "path": "                                                                                                                                  \n      parser: ",
+      "file": "sast/xpath-injection.js",
+      "line": 69,
+      "requiresAuth": false
+    },
+    {
+      "kind": "queue-consumer",
+      "id": "queue:sast/sensitive-data-logging.js:67",
+      "file": "sast/sensitive-data-logging.js",
+      "line": 67
+    }
+  ],
+  "boundaries": [
+    {
+      "from": "external",
+      "to": "route:GET:/api/endpoint",
+      "kind": "trust-boundary",
+      "requiresAuth": false
+    },
+    {
+      "from": "external",
+      "to": "route:GET:/api/users/2",
+      "kind": "trust-boundary",
+      "requiresAuth": false
+    },
+    {
+      "from": "external",
+      "to": "route:GET:/api/admin/users",
+      "kind": "trust-boundary",
+      "requiresAuth": false
+    },
+    {
+      "from": "external",
+      "to": "route:GET:/api/health",
+      "kind": "trust-boundary",
+      "requiresAuth": false
+    },
+    {
+      "from": "external",
+      "to": "route:GET:                                                                                                                                  \n      parser: ",
+      "kind": "trust-boundary",
+      "requiresAuth": false
+    },
+    {
+      "from": "external",
+      "to": "queue:sast/sensitive-data-logging.js:67",
+      "kind": "trust-boundary"
+    }
+  ],
+  "assets": [],
+  "threats": [
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "medium",
+      "file": "poc-video.js",
+      "line": 98,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:poc-video.js:98",
+      "affectsAsset": null,
+      "atEntity": "route:GET:/api/endpoint"
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "medium",
+      "file": "poc-video.js",
+      "line": 98,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:poc-video.js:98",
+      "affectsAsset": null,
+      "atEntity": "route:GET:/api/endpoint"
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "medium",
+      "file": "posture/deploy-platform.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/deploy-platform.js:13:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "posture/attack-playbooks.js",
+      "line": 72,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:posture/attack-playbooks.js:72",
+      "affectsAsset": null,
+      "atEntity": "route:GET:/api/users/2"
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "posture/attack-playbooks.js",
+      "line": 72,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:posture/attack-playbooks.js:72",
+      "affectsAsset": null,
+      "atEntity": "route:GET:/api/users/2"
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-915",
+      "family": "mass-assignment",
+      "severity": "low",
+      "file": "ir/parser-cs.js",
+      "vuln": "Mass Assignment (req.body Direct to Model)",
+      "finding_id": "struct:ir/parser-cs.js:208:Mass_Assignment_(req.body_Direct_to_Model)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-915",
+      "family": "mass-assignment",
+      "severity": "low",
+      "file": "ir/parser-go.js",
+      "vuln": "Mass Assignment (req.body Direct to Model)",
+      "finding_id": "struct:ir/parser-go.js:253:Mass_Assignment_(req.body_Direct_to_Model)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-915",
+      "family": "mass-assignment",
+      "severity": "low",
+      "file": "ir/parser-kt.js",
+      "vuln": "Mass Assignment (req.body Direct to Model)",
+      "finding_id": "struct:ir/parser-kt.js:207:Mass_Assignment_(req.body_Direct_to_Model)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-915",
+      "family": "mass-assignment",
+      "severity": "low",
+      "file": "ir/parser-php.js",
+      "vuln": "Mass Assignment (req.body Direct to Model)",
+      "finding_id": "struct:ir/parser-php.js:209:Mass_Assignment_(req.body_Direct_to_Model)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-915",
+      "family": "mass-assignment",
+      "severity": "low",
+      "file": "ir/parser-rb.js",
+      "vuln": "Mass Assignment (req.body Direct to Model)",
+      "finding_id": "struct:ir/parser-rb.js:201:Mass_Assignment_(req.body_Direct_to_Model)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-915",
+      "family": "mass-assignment",
+      "severity": "low",
+      "file": "posture/integrity.js",
+      "vuln": "Mass Assignment (req.body Direct to Model)",
+      "finding_id": "struct:posture/integrity.js:69:Mass_Assignment_(req.body_Direct_to_Model)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-502",
+      "family": "unsafe-deserialization-user-controlled-j",
+      "severity": "low",
+      "file": "sca/sigstore-verify.js",
+      "vuln": "Unsafe Deserialization (User-Controlled JSON)",
+      "finding_id": "struct:sca/sigstore-verify.js:159:Unsafe_Deserialization_(User-Controlled_JSON)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "badge.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:badge.js:46:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "history-scan.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:history-scan.js:171:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "leaderboard.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:leaderboard.js:95:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "dataflow/cross-service-taint.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:dataflow/cross-service-taint.js:53:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "dataflow/ifds-precise.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:dataflow/ifds-precise.js:177:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "dataflow/incremental.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:dataflow/incremental.js:50:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "integrations/index.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:integrations/index.js:24:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "integrations/tickets.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:integrations/tickets.js:26:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "ir/cpp-preprocessor.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:ir/cpp-preprocessor.js:94:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "ir/type-stubs.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:ir/type-stubs.js:48:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "llm-validator/consistency.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:llm-validator/consistency.js:66:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "llm-validator/index.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:llm-validator/index.js:119:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "mcp/audit.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:mcp/audit.js:52:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "mcp/server.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:mcp/server.js:32:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "mcp/tools.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:mcp/tools.js:159:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/agents-memory.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/agents-memory.js:44:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/api-contract.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/api-contract.js:38:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/auditor-walkthrough.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/auditor-walkthrough.js:39:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/auth-posture-import.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/auth-posture-import.js:53:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/blast-radius.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/blast-radius.js:201:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/calibration-drift.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/calibration-drift.js:40:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/calibration.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/calibration.js:99:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/compliance-policy.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/compliance-policy.js:48:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/cross-repo-memory.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/cross-repo-memory.js:56:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/custom-rules.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/custom-rules.js:57:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/cve-alert-daemon.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/cve-alert-daemon.js:218:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/cve-lookup.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/cve-lookup.js:32:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/dep-add-guard.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/dep-add-guard.js:28:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/deterministic.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/deterministic.js:47:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/epss.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/epss.js:34:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/exploitability-probability.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/exploitability-probability.js:142:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/feature-flags.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/feature-flags.js:53:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/federated-learning.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/federated-learning.js:55:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/findings-memory.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/findings-memory.js:21:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/fix-history.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/fix-history.js:31:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/fix-plan.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/fix-plan.js:111:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/fix-style-mirror.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/fix-style-mirror.js:44:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/fix-verify-loop.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/fix-verify-loop.js:33:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/grader-calibration.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/grader-calibration.js:34:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/holdout-eval.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/holdout-eval.js:73:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/integrity.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/integrity.js:43:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/intent-context.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/intent-context.js:48:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/learning.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/learning.js:30:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/license-attributions.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/license-attributions.js:87:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/license-graph.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/license-graph.js:227:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/license-policy.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/license-policy.js:30:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/model-rescan.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/model-rescan.js:21:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/network-policy-import.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/network-policy-import.js:49:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/policy-gate.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/policy-gate.js:154:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/pqc-migration-plan.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/pqc-migration-plan.js:121:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/pr-augment.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/pr-augment.js:36:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/pre-incident-archaeology.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/pre-incident-archaeology.js:31:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/profile.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/profile.js:46:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/realtime-cve-monitor.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/realtime-cve-monitor.js:38:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/risk-dollars.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/risk-dollars.js:83:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/router.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/router.js:21:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/rule-overrides.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/rule-overrides.js:22:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/rule-pack-signing.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/rule-pack-signing.js:66:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/rule-synthesis.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/rule-synthesis.js:22:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/ruleset-version.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/ruleset-version.js:36:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/runtime-correlation.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/runtime-correlation.js:46:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/sbom-diff.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/sbom-diff.js:61:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/sca-policy.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/sca-policy.js:53:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/security-trend.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/security-trend.js:16:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/stack-playbook.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/stack-playbook.js:13:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/state-dir.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/state-dir.js:39:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/streak.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/streak.js:40:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/suppressions.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/suppressions.js:24:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/telemetry-ingest.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/telemetry-ingest.js:41:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/threat-model-auto.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/threat-model-auto.js:216:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/threat-model-grounding.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/threat-model-grounding.js:34:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/time-to-fix.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/time-to-fix.js:54:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/triage-learning.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/triage-learning.js:49:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/triage-memory.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/triage-memory.js:61:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/triage.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/triage.js:20:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/validator-metrics.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/validator-metrics.js:35:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/verifier-ephemeral.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/verifier-ephemeral.js:90:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/verifier-target.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/verifier-target.js:66:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/verifier.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/verifier.js:129:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/version.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/version.js:43:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/waf-ingest.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/waf-ingest.js:138:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/workflow-installer.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/workflow-installer.js:24:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "sca/dep-confusion.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:sca/dep-confusion.js:56:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "sca/llm-function-extract.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:sca/llm-function-extract.js:24:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "sca/py-package-functions.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:sca/py-package-functions.js:19:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "sca/sarif-ingest.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:sca/sarif-ingest.js:112:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "sca/sigstore-verify.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:sca/sigstore-verify.js:53:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "ir/parser-py-cst.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:ir/parser-py-cst.js:91:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/fix-verify.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/fix-verify.js:65:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "posture/sca-upgrade.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:posture/sca-upgrade.js:79:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "dos-sync-io",
+      "severity": "low",
+      "file": "sca/binary-metadata.js",
+      "vuln": "Synchronous Blocking I/O (DoS Risk in Server Context)",
+      "finding_id": "struct:sca/binary-metadata.js:47:Synchronous_Blocking_I/O_(DoS_Risk_in_Server_Context)",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-295",
+      "family": "crypto-tls-no-verify",
+      "severity": "medium",
+      "file": "sast/crypto-protocol.js",
+      "line": 105,
+      "vuln": "TLS certificate verification disabled — MITM-vulnerable",
+      "finding_id": "crypto-tls-no-verify:sast/crypto-protocol.js:105",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-295",
+      "family": "crypto-tls-no-verify",
+      "severity": "medium",
+      "file": "sast/crypto-protocol.js",
+      "line": 108,
+      "vuln": "TLS certificate verification disabled — MITM-vulnerable",
+      "finding_id": "crypto-tls-no-verify:sast/crypto-protocol.js:108",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-295",
+      "family": "crypto-tls-no-verify",
+      "severity": "medium",
+      "file": "sast/crypto-protocol.js",
+      "line": 114,
+      "vuln": "TLS certificate verification disabled — MITM-vulnerable",
+      "finding_id": "crypto-tls-no-verify:sast/crypto-protocol.js:114",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-295",
+      "family": "crypto-tls-no-verify",
+      "severity": "medium",
+      "file": "sast/crypto-protocol.js",
+      "line": 116,
+      "vuln": "TLS certificate verification disabled — MITM-vulnerable",
+      "finding_id": "crypto-tls-no-verify:sast/crypto-protocol.js:116",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-295",
+      "family": "crypto-tls-no-verify",
+      "severity": "medium",
+      "file": "sast/crypto-protocol.js",
+      "line": 118,
+      "vuln": "TLS certificate verification disabled — MITM-vulnerable",
+      "finding_id": "crypto-tls-no-verify:sast/crypto-protocol.js:118",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-345",
+      "family": "eth-sign-used",
+      "severity": "medium",
+      "file": "sast/dapp-frontend.js",
+      "line": 74,
+      "vuln": "eth_sign — signs arbitrary 32-byte hash with no prefix (the \"death sign\")",
+      "finding_id": "dapp-eth-sign:sast/dapp-frontend.js:74",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-841",
+      "family": "state-machine-bypass",
+      "severity": "medium",
+      "file": "integrations/tickets.js",
+      "line": 191,
+      "vuln": "State-machine bypass: write 'closed' not in declared set pending,approved,rejected",
+      "finding_id": "state-machine:integrations/tickets.js:191:closed",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-841",
+      "family": "state-machine-bypass",
+      "severity": "medium",
+      "file": "posture/business-logic.js",
+      "line": 141,
+      "vuln": "State-machine bypass: write '<not in set>' not in declared set pending,approved,rejected",
+      "finding_id": "state-machine:posture/business-logic.js:141:<not in set>",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-841",
+      "family": "state-machine-bypass",
+      "severity": "medium",
+      "file": "posture/fix-history.js",
+      "line": 261,
+      "vuln": "State-machine bypass: write 'failed' not in declared set pending,approved,rejected",
+      "finding_id": "state-machine:posture/fix-history.js:261:failed",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-841",
+      "family": "state-machine-bypass",
+      "severity": "medium",
+      "file": "posture/fix-history.js",
+      "line": 267,
+      "vuln": "State-machine bypass: write 'applied' not in declared set pending,approved,rejected",
+      "finding_id": "state-machine:posture/fix-history.js:267:applied",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-841",
+      "family": "state-machine-bypass",
+      "severity": "medium",
+      "file": "posture/fix-history.js",
+      "line": 312,
+      "vuln": "State-machine bypass: write 'failed' not in declared set pending,approved,rejected",
+      "finding_id": "state-machine:posture/fix-history.js:312:failed",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-841",
+      "family": "state-machine-bypass",
+      "severity": "medium",
+      "file": "posture/fix-history.js",
+      "line": 322,
+      "vuln": "State-machine bypass: write 'applied-stale' not in declared set pending,approved,rejected",
+      "finding_id": "state-machine:posture/fix-history.js:322:applied-stale",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-841",
+      "family": "state-machine-bypass",
+      "severity": "medium",
+      "file": "posture/fix-history.js",
+      "line": 325,
+      "vuln": "State-machine bypass: write 'applied' not in declared set pending,approved,rejected",
+      "finding_id": "state-machine:posture/fix-history.js:325:applied",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-841",
+      "family": "state-machine-bypass",
+      "severity": "medium",
+      "file": "posture/fix-history.js",
+      "line": 330,
+      "vuln": "State-machine bypass: write 'failed' not in declared set pending,approved,rejected",
+      "finding_id": "state-machine:posture/fix-history.js:330:failed",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-841",
+      "family": "state-machine-bypass",
+      "severity": "medium",
+      "file": "posture/fix-history.js",
+      "line": 335,
+      "vuln": "State-machine bypass: write 'failed' not in declared set pending,approved,rejected",
+      "finding_id": "state-machine:posture/fix-history.js:335:failed",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-841",
+      "family": "state-machine-bypass",
+      "severity": "medium",
+      "file": "posture/triage.js",
+      "line": 68,
+      "vuln": "State-machine bypass: write 'fixed' not in declared set pending,approved,rejected",
+      "finding_id": "state-machine:posture/triage.js:68:fixed",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-841",
+      "family": "state-machine-bypass",
+      "severity": "medium",
+      "file": "sast/logic.js",
+      "line": 29,
+      "vuln": "State-machine bypass: write 'completed' not in declared set pending,approved,rejected",
+      "finding_id": "state-machine:sast/logic.js:29:completed",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-770",
+      "family": "spec-drift",
+      "severity": "medium",
+      "file": "sast/rate-limit.js",
+      "line": 34,
+      "vuln": "Spec drift — _hasRateLimit() claims rate-limit-impl but body lacks expected evidence",
+      "finding_id": "spec-drift:rate-limit-impl:sast/rate-limit.js:34",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-770",
+      "family": "spec-drift",
+      "severity": "medium",
+      "file": "sast/rate-limit.js",
+      "line": 77,
+      "vuln": "Spec drift — scanRateLimit() claims rate-limit-impl but body lacks expected evidence",
+      "finding_id": "spec-drift:rate-limit-impl:sast/rate-limit.js:77",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-1336",
+      "family": "prompt-template-user-input-interpolated-",
+      "severity": "low",
+      "file": "llm-validator/index.js",
+      "line": 58,
+      "vuln": "Prompt Template: user input interpolated into prompt string without isolation",
+      "finding_id": "prompt-tpl:llm-validator/index.js:58:Prompt_Template__user_input_interpolated_into_prompt_string_",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-1321",
+      "family": "prototype-pollution",
+      "severity": "low",
+      "file": "posture/adversarial-self-test.js",
+      "line": 60,
+      "vuln": "Prototype Pollution: Direct write to __proto__ / constructor.prototype",
+      "finding_id": "prototype-pollution-direct:posture/adversarial-self-test.js:60",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-1321",
+      "family": "prototype-pollution",
+      "severity": "low",
+      "file": "posture/adversarial-self-test.js",
+      "line": 60,
+      "vuln": "Prototype Pollution: Direct write to __proto__ / constructor.prototype",
+      "finding_id": "prototype-pollution-direct:posture/adversarial-self-test.js:60",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-77",
+      "family": "user-input-concatenated-into-system-prom",
+      "severity": "low",
+      "file": "posture/adversary-agent.js",
+      "line": 109,
+      "vuln": "User input concatenated into system prompt — direct prompt injection",
+      "finding_id": "llm-redteam:userInputInSystem:posture/adversary-agent.js:109",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-1336",
+      "family": "prompt-template-user-input-interpolated-",
+      "severity": "low",
+      "file": "posture/llm-redteam-prompts.js",
+      "line": 332,
+      "vuln": "Prompt Template: user input interpolated into prompt string without isolation",
+      "finding_id": "prompt-tpl:posture/llm-redteam-prompts.js:332:Prompt_Template__user_input_interpolated_into_prompt_string_",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-347",
+      "family": "idor",
+      "severity": "low",
+      "file": "sast/authz.js",
+      "line": 33,
+      "vuln": "AuthZ: jwt.verify called without algorithms allow-list",
+      "finding_id": "authz:sast/authz.js:33:AuthZ__jwt_verify_called_without_algorithms_allow_list",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-349",
+      "family": "cache-poisoning",
+      "severity": "low",
+      "file": "sast/cache-poisoning.js",
+      "line": 20,
+      "vuln": "Cache Poisoning — X-Forwarded-Host reflected from request to response",
+      "finding_id": "cache-poison-reflect:sast/cache-poisoning.js:20",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-95",
+      "family": "client-side-eval-with-dynamic-input",
+      "severity": "low",
+      "file": "sast/client-side.js",
+      "line": 135,
+      "vuln": "Client-Side — eval with Dynamic Input",
+      "finding_id": "client-side:CLIENT_EVAL:sast/client-side.js:135",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-95",
+      "family": "client-side-eval-with-dynamic-input",
+      "severity": "low",
+      "file": "sast/client-side.js",
+      "line": 139,
+      "vuln": "Client-Side — eval with Dynamic Input",
+      "finding_id": "client-side:CLIENT_EVAL:sast/client-side.js:139",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-95",
+      "family": "client-side-eval-with-dynamic-input",
+      "severity": "low",
+      "file": "sast/client-side.js",
+      "line": 140,
+      "vuln": "Client-Side — eval with Dynamic Input",
+      "finding_id": "client-side:CLIENT_EVAL:sast/client-side.js:140",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-347",
+      "family": "idor",
+      "severity": "low",
+      "file": "sast/crypto-protocol.js",
+      "line": 374,
+      "vuln": "AuthZ: jwt.verify called without algorithms allow-list",
+      "finding_id": "authz:sast/crypto-protocol.js:374:AuthZ__jwt_verify_called_without_algorithms_allow_list",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-347",
+      "family": "idor",
+      "severity": "low",
+      "file": "sast/crypto-protocol.js",
+      "line": 375,
+      "vuln": "AuthZ: jwt.verify called without algorithms allow-list",
+      "finding_id": "authz:sast/crypto-protocol.js:375:AuthZ__jwt_verify_called_without_algorithms_allow_list",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-326",
+      "family": "crypto-tls-version",
+      "severity": "low",
+      "file": "sast/crypto-protocol.js",
+      "line": 67,
+      "vuln": "TLS configured to accept versions below TLS 1.2",
+      "finding_id": "crypto-tls-min-version:sast/crypto-protocol.js:67",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-326",
+      "family": "crypto-tls-version",
+      "severity": "low",
+      "file": "sast/crypto-protocol.js",
+      "line": 69,
+      "vuln": "TLS configured to accept versions below TLS 1.2",
+      "finding_id": "crypto-tls-min-version:sast/crypto-protocol.js:69",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-327",
+      "family": "crypto-weak-cipher",
+      "severity": "low",
+      "file": "sast/crypto-protocol.js",
+      "line": 141,
+      "vuln": "Weak symmetric cipher in use (DES / 3DES / RC4 / Blowfish / NULL / EXPORT)",
+      "finding_id": "crypto-weak-cipher:sast/crypto-protocol.js:141",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-327",
+      "family": "crypto-weak-cipher",
+      "severity": "low",
+      "file": "sast/crypto-protocol.js",
+      "line": 143,
+      "vuln": "Weak symmetric cipher in use (DES / 3DES / RC4 / Blowfish / NULL / EXPORT)",
+      "finding_id": "crypto-weak-cipher:sast/crypto-protocol.js:143",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-327",
+      "family": "crypto-weak-cipher",
+      "severity": "low",
+      "file": "sast/crypto-protocol.js",
+      "line": 145,
+      "vuln": "Weak symmetric cipher in use (DES / 3DES / RC4 / Blowfish / NULL / EXPORT)",
+      "finding_id": "crypto-weak-cipher:sast/crypto-protocol.js:145",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-327",
+      "family": "crypto-weak-cipher",
+      "severity": "low",
+      "file": "sast/crypto-protocol.js",
+      "line": 149,
+      "vuln": "Weak symmetric cipher in use (DES / 3DES / RC4 / Blowfish / NULL / EXPORT)",
+      "finding_id": "crypto-weak-cipher:sast/crypto-protocol.js:149",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-345",
+      "family": "crypto-jwt-key-confusion",
+      "severity": "low",
+      "file": "sast/crypto-protocol.js",
+      "line": 374,
+      "vuln": "jwt.verify called without algorithms allowlist — algorithm-confusion attack",
+      "finding_id": "crypto-jwt-no-algs-allowlist:sast/crypto-protocol.js:374",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-1336",
+      "family": "prompt-template-user-input-interpolated-",
+      "severity": "low",
+      "file": "sast/k8s-admission.js",
+      "line": 139,
+      "vuln": "Prompt Template: user input interpolated into prompt string without isolation",
+      "finding_id": "prompt-tpl:sast/k8s-admission.js:139:Prompt_Template__user_input_interpolated_into_prompt_string_",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-1427",
+      "family": "llm-app-security",
+      "severity": "low",
+      "file": "sast/llm-app.js",
+      "line": 93,
+      "vuln": "Prompt Injection — system prompt concatenated with user input",
+      "finding_id": "llm-prompt-injection-mix:93",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-1427",
+      "family": "llm-app-security",
+      "severity": "low",
+      "file": "sast/llm-app.js",
+      "line": 136,
+      "vuln": "RAG Injection — vector-store result flows into LLM prompt without sanitization",
+      "finding_id": "llm-rag-injection:136",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-1427",
+      "family": "llm-app-security",
+      "severity": "low",
+      "file": "sast/llm-app.js",
+      "line": 137,
+      "vuln": "RAG Injection — vector-store result flows into LLM prompt without sanitization",
+      "finding_id": "llm-rag-injection:137",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-502",
+      "family": "llm-app-security",
+      "severity": "low",
+      "file": "sast/llm-app.js",
+      "line": 163,
+      "vuln": "Untrusted Model Load — model file loaded from a non-literal path",
+      "finding_id": "llm-model-load-untrusted:163",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-1427",
+      "family": "prompt-injection-system-prompt-built-fro",
+      "severity": "low",
+      "file": "sast/llm-owasp.js",
+      "line": 180,
+      "vuln": "Prompt Injection — system prompt built from concatenated/interpolated content (LLM01)",
+      "finding_id": "llm-owasp:sast/llm-owasp.js:180:llm01-dynamic-system:concat",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-1427",
+      "family": "prompt-injection-system-prompt-built-fro",
+      "severity": "low",
+      "file": "sast/llm-owasp.js",
+      "line": 181,
+      "vuln": "Prompt Injection — system prompt built from concatenated/interpolated content (LLM01)",
+      "finding_id": "llm-owasp:sast/llm-owasp.js:181:llm01-dynamic-system:fstring",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-1427",
+      "family": "prompt-injection-system-prompt-built-fro",
+      "severity": "low",
+      "file": "sast/llm-owasp.js",
+      "line": 182,
+      "vuln": "Prompt Injection — system prompt built from concatenated/interpolated content (LLM01)",
+      "finding_id": "llm-owasp:sast/llm-owasp.js:182:llm01-dynamic-system:template",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-1336",
+      "family": "prompt-template-user-input-interpolated-",
+      "severity": "low",
+      "file": "sast/llm-owasp.js",
+      "line": 125,
+      "vuln": "Prompt Template: user input interpolated into prompt string without isolation",
+      "finding_id": "prompt-tpl:sast/llm-owasp.js:125:Prompt_Template__user_input_interpolated_into_prompt_string_",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-502",
+      "family": "llm-app-security",
+      "severity": "low",
+      "file": "sast/model-load.js",
+      "line": 45,
+      "vuln": "Untrusted Model Load — model file loaded from a non-literal path",
+      "finding_id": "llm-model-load-untrusted:45",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-79",
+      "family": "xss",
+      "severity": "low",
+      "file": "sast/mutation-xss.js",
+      "line": 123,
+      "vuln": "Markdown→HTML XSS — user-supplied Markdown rendered to HTML without sanitization",
+      "finding_id": "markdown-xss:sast/mutation-xss.js:123",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-327",
+      "family": "pqc-migration",
+      "severity": "low",
+      "file": "sast/post-quantum-crypto.js",
+      "line": 136,
+      "vuln": "Pre-quantum RSA (rsa-encrypt) — replace with ML-KEM-768 before CRQC arrives",
+      "finding_id": "pqc-rsa-encrypt:sast/post-quantum-crypto.js:136",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-22",
+      "family": "zip-slip",
+      "severity": "low",
+      "file": "sast/zip-slip.js",
+      "line": 192,
+      "vuln": "Zip Slip: archive entry.path written to filesystem without sanitization",
+      "finding_id": "zip-slip:sast/zip-slip.js:192:node-entry",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "badge.js",
+      "line": 46,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:badge.js:46",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "leaderboard.js",
+      "line": 103,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:leaderboard.js:103",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "pr-comment.js",
+      "line": 41,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:pr-comment.js:41",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "pr-comment.js",
+      "line": 41,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:pr-comment.js:41",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "runScan.js",
+      "line": 39,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:runScan.js:39",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "dataflow/catalog.js",
+      "line": 547,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:dataflow/catalog.js:547",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "dataflow/catalog.js",
+      "line": 547,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:dataflow/catalog.js:547",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "dataflow/cross-service-taint.js",
+      "line": 53,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:dataflow/cross-service-taint.js:53",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "dataflow/cross-service-taint.js",
+      "line": 97,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:dataflow/cross-service-taint.js:97",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "dataflow/exploit-prover.js",
+      "line": 33,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:dataflow/exploit-prover.js:33",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "dataflow/exploit-prover.js",
+      "line": 33,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:dataflow/exploit-prover.js:33",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "dataflow/ifds-precise.js",
+      "line": 177,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:dataflow/ifds-precise.js:177",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "dataflow/incremental.js",
+      "line": 50,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:dataflow/incremental.js:50",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "dataflow/incremental.js",
+      "line": 68,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:dataflow/incremental.js:68",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "integrations/index.js",
+      "line": 24,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:integrations/index.js:24",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "integrations/tickets.js",
+      "line": 26,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:integrations/tickets.js:26",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "integrations/tickets.js",
+      "line": 146,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:integrations/tickets.js:146",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-327",
+      "family": "crypto-weak-hash",
+      "severity": "low",
+      "file": "ir/parser-py.helper.py",
+      "line": 68,
+      "vuln": "Weak hash algorithm (MD5 / SHA-1 / MD2 / MD4) used",
+      "finding_id": "crypto-weak-hash:ir/parser-py.helper.py:68",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "ir/type-stubs.js",
+      "line": 48,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:ir/type-stubs.js:48",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-176",
+      "family": "path-normalization",
+      "severity": "low",
+      "file": "ir/universal-ir.js",
+      "line": 93,
+      "vuln": "Path Normalization Gap — extension extraction without null-byte/traversal sanitization",
+      "finding_id": "path-norm:ir/universal-ir.js:93",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "lsp/server.js",
+      "line": 114,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:lsp/server.js:114",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "lsp/server.js",
+      "line": 128,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:lsp/server.js:128",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "lsp/server.js",
+      "line": 204,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:lsp/server.js:204",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "llm-validator/index.js",
+      "line": 119,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:llm-validator/index.js:119",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "mcp/audit.js",
+      "line": 52,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:mcp/audit.js:52",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "mcp/audit.js",
+      "line": 127,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:mcp/audit.js:127",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "mcp/tools.js",
+      "line": 196,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:mcp/tools.js:196",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "mcp/tools.js",
+      "line": 320,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:mcp/tools.js:320",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "mcp/tools.js",
+      "line": 753,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:mcp/tools.js:753",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "mcp/tools.js",
+      "line": 835,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:mcp/tools.js:835",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/agents-memory.js",
+      "line": 44,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/agents-memory.js:44",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/agents-memory.js",
+      "line": 69,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/agents-memory.js:69",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/agents-memory.js",
+      "line": 72,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/agents-memory.js:72",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/agents-memory.js",
+      "line": 107,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/agents-memory.js:107",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "prompt-firewall-missing-max-tokens-cap",
+      "severity": "low",
+      "file": "posture/aibom.js",
+      "line": 31,
+      "vuln": "Prompt Firewall — Missing max_tokens Cap",
+      "finding_id": "prompt-firewall:MISSING_MAX_TOKENS:posture/aibom.js:31",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-770",
+      "family": "llm-call-without-max-tokens-unbounded-co",
+      "severity": "low",
+      "file": "posture/aibom.js",
+      "line": 31,
+      "vuln": "LLM call without max_tokens — unbounded cost / DoS",
+      "finding_id": "llm-redteam:noMaxTokens:posture/aibom.js:31",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-770",
+      "family": "llm-call-without-max-tokens-unbounded-co",
+      "severity": "low",
+      "file": "posture/aibom.js",
+      "line": 34,
+      "vuln": "LLM call without max_tokens — unbounded cost / DoS",
+      "finding_id": "llm-redteam:noMaxTokens:posture/aibom.js:34",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/auditor-walkthrough.js",
+      "line": 60,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/auditor-walkthrough.js:60",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/auth-posture-import.js",
+      "line": 53,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/auth-posture-import.js:53",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/calibration-drift.js",
+      "line": 40,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/calibration-drift.js:40",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/compliance-policy.js",
+      "line": 48,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/compliance-policy.js:48",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/compliance-policy.js",
+      "line": 109,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/compliance-policy.js:109",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/cross-repo-memory.js",
+      "line": 62,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/cross-repo-memory.js:62",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-176",
+      "family": "path-normalization",
+      "severity": "low",
+      "file": "posture/custom-rules.js",
+      "line": 182,
+      "vuln": "Path Normalization Gap — extension extraction without null-byte/traversal sanitization",
+      "finding_id": "path-norm:posture/custom-rules.js:182",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/cve-alert-daemon.js",
+      "line": 271,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/cve-alert-daemon.js:271",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/cve-alert-daemon.js",
+      "line": 289,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/cve-alert-daemon.js:289",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/cve-lookup.js",
+      "line": 32,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/cve-lookup.js:32",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "posture/defender-agent.js",
+      "line": 41,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:posture/defender-agent.js:41",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "posture/defender-agent.js",
+      "line": 41,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:posture/defender-agent.js:41",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/dep-add-guard.js",
+      "line": 28,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/dep-add-guard.js:28",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/dep-add-guard.js",
+      "line": 65,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/dep-add-guard.js:65",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/deterministic.js",
+      "line": 53,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/deterministic.js:53",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/epss.js",
+      "line": 34,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/epss.js:34",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/exploitability-probability.js",
+      "line": 142,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/exploitability-probability.js:142",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/feature-flags.js",
+      "line": 53,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/feature-flags.js:53",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/federated-learning.js",
+      "line": 60,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/federated-learning.js:60",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/fix-history.js",
+      "line": 31,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/fix-history.js:31",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/fix-history.js",
+      "line": 48,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/fix-history.js:48",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-176",
+      "family": "path-normalization",
+      "severity": "low",
+      "file": "posture/fix-style-mirror.js",
+      "line": 39,
+      "vuln": "Path Normalization Gap — extension extraction without null-byte/traversal sanitization",
+      "finding_id": "path-norm:posture/fix-style-mirror.js:39",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/fix-style-mirror.js",
+      "line": 97,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/fix-style-mirror.js:97",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/fix-verify-loop.js",
+      "line": 33,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/fix-verify-loop.js:33",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "posture/flow-narration.js",
+      "line": 24,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:posture/flow-narration.js:24",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "posture/flow-narration.js",
+      "line": 24,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:posture/flow-narration.js:24",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/grader-calibration.js",
+      "line": 34,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/grader-calibration.js:34",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/harness-discovery.js",
+      "line": 39,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/harness-discovery.js:39",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/holdout-eval.js",
+      "line": 73,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/holdout-eval.js:73",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/integrity.js",
+      "line": 43,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/integrity.js:43",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/integrity.js",
+      "line": 77,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/integrity.js:77",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/learning.js",
+      "line": 30,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/learning.js:30",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/license-graph.js",
+      "line": 227,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/license-graph.js:227",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/license-policy.js",
+      "line": 30,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/license-policy.js:30",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/network-policy-import.js",
+      "line": 85,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/network-policy-import.js:85",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/policy-gate.js",
+      "line": 154,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/policy-gate.js:154",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/profile.js",
+      "line": 46,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/profile.js:46",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/profile.js",
+      "line": 77,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/profile.js:77",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/realtime-cve-monitor.js",
+      "line": 38,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/realtime-cve-monitor.js:38",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/risk-dollars.js",
+      "line": 83,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/risk-dollars.js:83",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/router.js",
+      "line": 21,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/router.js:21",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/rule-overrides.js",
+      "line": 22,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/rule-overrides.js:22",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/rule-overrides.js",
+      "line": 72,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/rule-overrides.js:72",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/rule-pack-signing.js",
+      "line": 66,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/rule-pack-signing.js:66",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/rule-pack-signing.js",
+      "line": 108,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/rule-pack-signing.js:108",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/rule-pack-signing.js",
+      "line": 155,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/rule-pack-signing.js:155",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-327",
+      "family": "pqc-migration",
+      "severity": "low",
+      "file": "posture/rule-pack-signing.js",
+      "line": 187,
+      "vuln": "Pre-quantum ED25519 (ed25519) — replace with ML-DSA-65 before CRQC arrives",
+      "finding_id": "pqc-ed25519:posture/rule-pack-signing.js:187",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/rule-synthesis.js",
+      "line": 22,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/rule-synthesis.js:22",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/ruleset-version.js",
+      "line": 36,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/ruleset-version.js:36",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/sbom-diff.js",
+      "line": 76,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/sbom-diff.js:76",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/sca-policy.js",
+      "line": 53,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/sca-policy.js:53",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/sca-upgrade.js",
+      "line": 79,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/sca-upgrade.js:79",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/suppressions.js",
+      "line": 24,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/suppressions.js:24",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/telemetry-ingest.js",
+      "line": 41,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/telemetry-ingest.js:41",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/time-to-fix.js",
+      "line": 54,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/time-to-fix.js:54",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/triage-learning.js",
+      "line": 49,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/triage-learning.js:49",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/triage-memory.js",
+      "line": 82,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/triage-memory.js:82",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/triage.js",
+      "line": 20,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/triage.js:20",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/validator-metrics.js",
+      "line": 35,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/validator-metrics.js:35",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/verifier-target.js",
+      "line": 66,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/verifier-target.js:66",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "posture/verifier.js",
+      "line": 55,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:posture/verifier.js:55",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "posture/verifier.js",
+      "line": 55,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:posture/verifier.js:55",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/version.js",
+      "line": 43,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/version.js:43",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/waf-ingest.js",
+      "line": 138,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/waf-ingest.js:138",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "posture/workflow-installer.js",
+      "line": 24,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:posture/workflow-installer.js:24",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "sca/binary-metadata.js",
+      "line": 47,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:sca/binary-metadata.js:47",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "sca/binary-metadata.js",
+      "line": 67,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:sca/binary-metadata.js:67",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "sca/dep-confusion.js",
+      "line": 56,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:sca/dep-confusion.js:56",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-367",
+      "family": "toctou-file-existence-permission-check-b",
+      "severity": "low",
+      "file": "sca/sigstore-verify.js",
+      "line": 53,
+      "vuln": "TOCTOU: file existence/permission check before open",
+      "finding_id": "toctou-fs:sca/sigstore-verify.js:53",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "sast/csharp-structural.js",
+      "line": 60,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:sast/csharp-structural.js:60",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "sast/csharp-structural.js",
+      "line": 60,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:sast/csharp-structural.js:60",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "sast/go-extended.js",
+      "line": 39,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:sast/go-extended.js:39",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "sast/go-extended.js",
+      "line": 39,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:sast/go-extended.js:39",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-644",
+      "family": "cache-poisoning",
+      "severity": "low",
+      "file": "sast/host-header.js",
+      "line": 99,
+      "vuln": "Cache Poisoning — Host header used in URL/redirect generation",
+      "finding_id": "cache-poison-host:sast/host-header.js:99",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "sast/java-structural.js",
+      "line": 76,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:sast/java-structural.js:76",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "sast/java-structural.js",
+      "line": 76,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:sast/java-structural.js:76",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "sast/js-framework-structural.js",
+      "line": 69,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:sast/js-framework-structural.js:69",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "sast/js-framework-structural.js",
+      "line": 69,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:sast/js-framework-structural.js:69",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "sast/kotlin.js",
+      "line": 136,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:sast/kotlin.js:136",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "sast/kotlin.js",
+      "line": 136,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:sast/kotlin.js:136",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-77",
+      "family": "system-prompt-missing-explicit-anti-inje",
+      "severity": "low",
+      "file": "sast/llm-app.js",
+      "line": 104,
+      "vuln": "System prompt missing explicit anti-injection guidance — model may follow user-supplied \"ignore previous\" attacks",
+      "finding_id": "llm-redteam:noPromptInjectionDefense:sast/llm-app.js:104",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-400",
+      "family": "unbounded-consumption-llm-call-has-no-to",
+      "severity": "low",
+      "file": "sast/llm-owasp.js",
+      "line": 183,
+      "vuln": "Unbounded Consumption — LLM call has no token budget (LLM10)",
+      "finding_id": "llm-owasp:sast/llm-owasp.js:183:llm10-no-token-budget",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "sast/php.js",
+      "line": 111,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:sast/php.js:111",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "sast/php.js",
+      "line": 111,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:sast/php.js:111",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "sast/python-sinks.js",
+      "line": 186,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:sast/python-sinks.js:186",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "sast/python-sinks.js",
+      "line": 186,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:sast/python-sinks.js:186",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "T",
+      "strideLabel": "Tampering",
+      "cwe": "CWE-532",
+      "family": "sensitive-data-logging",
+      "severity": "low",
+      "file": "sast/sensitive-data-logging.js",
+      "line": 67,
+      "vuln": "Sensitive Data Logged — PII-named variable sent to logger without sanitization",
+      "finding_id": "sensitive-log:sast/sensitive-data-logging.js:67",
+      "affectsAsset": null,
+      "atEntity": "queue:sast/sensitive-data-logging.js:67"
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "sast/ssrf-cloud-metadata.js",
+      "line": 61,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:sast/ssrf-cloud-metadata.js:61",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "sast/ssrf-cloud-metadata.js",
+      "line": 61,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:sast/ssrf-cloud-metadata.js:61",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "sast/ssrf-cloud-metadata.js",
+      "line": 86,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:sast/ssrf-cloud-metadata.js:86",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "sast/ssrf-cloud-metadata.js",
+      "line": 86,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:sast/ssrf-cloud-metadata.js:86",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "sast/ssrf-cloud-metadata.js",
+      "line": 15,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:sast/ssrf-cloud-metadata.js:15",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "E",
+      "strideLabel": "Elevation of Privilege",
+      "cwe": "CWE-918",
+      "family": "ssrf",
+      "severity": "low",
+      "file": "sast/ssrf-cloud-metadata.js",
+      "line": 15,
+      "vuln": "SSRF: explicit reference to cloud instance-metadata endpoint",
+      "finding_id": "ssrf-meta-hardcoded:sast/ssrf-cloud-metadata.js:15",
+      "affectsAsset": null,
+      "atEntity": null
+    },
+    {
+      "stride": "I",
+      "strideLabel": "Information Disclosure",
+      "cwe": "CWE-327",
+      "family": "crypto-weak-hash",
+      "severity": "low",
+      "file": "sast/weak-password-hash.js",
+      "line": 45,
+      "vuln": "Weak hash algorithm (MD5 / SHA-1 / MD2 / MD4) used",
+      "finding_id": "crypto-weak-hash:sast/weak-password-hash.js:45",
+      "affectsAsset": null,
+      "atEntity": null
+    }
+  ],
+  "attackTrees": []
+}