@hoanghainh/komagu 2.0.0 → 2.1.0

package/assess/lsa/examples/eval-run-4/iter1-gptoss-a/findings.json

@@ -0,0 +1,4870 @@
+{
+  "generated_by": "lsa merge_findings.py 0.3.1",
+  "summary": {
+    "total_reported": 92,
+    "active": 73,
+    "rejected_by_verifier": 19,
+    "by_severity": {
+      "critical": 34,
+      "high": 34,
+      "medium": 5,
+      "low": 0,
+      "info": 0
+    },
+    "by_category": {
+      "bola": 34,
+      "sql_injection": 28,
+      "nosql_injection": 0,
+      "bfla": 1,
+      "mass_assignment": 10
+    },
+    "by_status": {
+      "unverified": 12,
+      "confirmed": 56,
+      "likely": 0,
+      "rejected": 19,
+      "needs_review": 5
+    }
+  },
+  "findings": [
+    {
+      "finding_id": "BFLA-R-0059-1",
+      "category": "bfla",
+      "subtype": "client_side_role_check",
+      "title": "Client‑side role check only in PHP manage_users.php",
+      "route_id": "R-0059",
+      "location": {
+        "file": "php-plain/manage_users.php",
+        "start_line": 1
+      },
+      "evidence": [
+        {
+          "file": "php-plain/manage_users.php",
+          "line": 6,
+          "why": "DELETE user – privileged action"
+        },
+        {
+          "file": "php-plain/manage_users.php",
+          "line": 11,
+          "why": "role check only in UI, not server side"
+        }
+      ],
+      "impact": "Any authenticated user can delete any user record",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-285"
+      ],
+      "recommendation": "Add a server‑side role check before executing the DELETE",
+      "status": "unverified",
+      "fingerprint": "kfp1:46a95c25c9fdd0024572d331fd6b49713b18fd6e351df3afa986ca37372da405",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "INJ-I-0001-1",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in classic-asp/shop/member.asp:6",
+      "candidate_id": "I-0001",
+      "location": {
+        "file": "classic-asp/shop/member.asp",
+        "start_line": 6
+      },
+      "evidence": [
+        {
+          "file": "classic-asp/shop/member.asp",
+          "start_line": 6,
+          "code": "sql = \"UPDATE members SET name = '\" & Replace(Request.Form(\"name\"), \"'\", \"''\") & \"'\"",
+          "why": "User input \"name\" is escaped but still concatenated",
+          "line": 6
+        },
+        {
+          "file": "classic-asp/shop/member.asp",
+          "start_line": 7,
+          "code": "sql = sql & \" WHERE member_id = \" & Request.Form(\"member_id\")",
+          "why": "Unsanitized member_id concatenated into query",
+          "line": 7
+        },
+        {
+          "file": "classic-asp/shop/member.asp",
+          "start_line": 8,
+          "code": "conn.Execute sql",
+          "why": "Query executed without parameterization",
+          "line": 8
+        }
+      ],
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "recommendation": "Use parameterized queries",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "classic-asp/shop/member.asp lines 6-8",
+          "global include files for request handling (none found)",
+          "no integer cast or allow‑list applied to Request.Form(\"member_id\")"
+        ],
+        "control_found": null,
+        "notes": "The code concatenates an unsanitized member_id from the form directly into an UPDATE statement. No global filter, type cast, or allow‑list is present to neutralise the injection.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Direct string concatenation of user input into SQL with no mitigating controls."
+      },
+      "fingerprint": "kfp1:52c63ccaf583de3933acccb3eff1f79314c58ac311cdeecdfc26c798403a7c89",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "INJ-I-0003-1",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in classic-asp/shop/member.asp:10",
+      "candidate_id": "I-0003",
+      "location": {
+        "file": "classic-asp/shop/member.asp",
+        "start_line": 10
+      },
+      "evidence": [
+        {
+          "file": "classic-asp/shop/member.asp",
+          "start_line": 10,
+          "code": "conn.Execute \"DELETE FROM members WHERE member_id = \" & Request.QueryString(\"member_id\")",
+          "why": "Unsanitized member_id concatenated into query",
+          "line": 10
+        }
+      ],
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "recommendation": "Use parameterized queries",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "classic-asp/shop/member.asp line 10",
+          "no integer cast or allow‑list applied to Request.QueryString(\"member_id\")"
+        ],
+        "control_found": null,
+        "notes": "The DELETE statement uses an unsanitized member_id from the query string. No compensating control is present.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Unsanitized user input concatenated into SQL."
+      },
+      "fingerprint": "kfp1:f1fb34f9c39374bc339b3dc230f5ac6b00731c69bf6cd1399b983ba2d2833525",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "INJ-I-0004-1",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in classic-asp/shop/order.asp:6",
+      "candidate_id": "I-0004",
+      "location": {
+        "file": "classic-asp/shop/order.asp",
+        "start_line": 6
+      },
+      "evidence": [
+        {
+          "file": "classic-asp/shop/order.asp",
+          "start_line": 6,
+          "code": "Set rs = conn.Execute(\"SELECT * FROM orders WHERE id = \" & id)",
+          "why": "Unsanitized id concatenated into query",
+          "line": 6
+        }
+      ],
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "recommendation": "Use parameterized queries",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "classic-asp/shop/order.asp line 6",
+          "no integer cast or allow‑list applied to the id variable"
+        ],
+        "control_found": null,
+        "notes": "The SELECT statement concatenates an unsanitized id value. No global filter or type cast is applied.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Direct concatenation of user input into SQL."
+      },
+      "fingerprint": "kfp1:07b1c914202a928e4156e6b6e9e5ab32fe7a75cdceda182d55d68051eeb61ac9",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "INJ-I-0006-1",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in coldfusion/app/OrderService.cfc:5",
+      "candidate_id": "I-0006",
+      "location": {
+        "file": "coldfusion/app/OrderService.cfc",
+        "start_line": 5
+      },
+      "evidence": [
+        {
+          "file": "coldfusion/app/OrderService.cfc",
+          "start_line": 5,
+          "code": "SELECT * FROM orders WHERE id = #arguments.orderId#",
+          "why": "Unsanitized orderId interpolated into query",
+          "line": 5
+        }
+      ],
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "recommendation": "Use cfqueryparam to bind parameters",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "coldfusion/app/OrderService.cfc line 5",
+          "no <cfqueryparam> or type hint on arguments.orderId",
+          "no global filter that casts orderId to numeric"
+        ],
+        "control_found": null,
+        "notes": "The query interpolates arguments.orderId directly. Without a type hint or cfqueryparam, the value is not sanitized.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Unparameterised interpolation of user input."
+      },
+      "fingerprint": "kfp1:b6824160d6d38156b7a16dc1526dda6be874be4401ad843a3c185f94446dcf5e",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "INJ-I-0007-1",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in coldfusion/app/order.cfm:3",
+      "candidate_id": "I-0007",
+      "location": {
+        "file": "coldfusion/app/order.cfm",
+        "start_line": 3
+      },
+      "evidence": [
+        {
+          "file": "coldfusion/app/order.cfm",
+          "start_line": 3,
+          "code": "SELECT * FROM orders WHERE id = #url.id#",
+          "why": "Unsanitized url.id interpolated into query",
+          "line": 3
+        }
+      ],
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "recommendation": "Use cfqueryparam to bind parameters",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "coldfusion/app/order.cfm line 3",
+          "no <cfqueryparam> or type hint on url.id",
+          "no global filter that casts url.id to numeric"
+        ],
+        "control_found": null,
+        "notes": "The query uses url.id directly in the WHERE clause. No sanitisation or type enforcement is present.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Direct interpolation of user input into SQL."
+      },
+      "fingerprint": "kfp1:d2650d07ae7cedfc90bd1abda3c42a63716563d54c45ecde428ae21505214f72",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "INJ-I-0008",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in dotnet-legacy/Web/Controllers/InvoiceController.cs:28",
+      "candidate_id": "I-0008",
+      "location": {
+        "file": "dotnet-legacy/Web/Controllers/InvoiceController.cs",
+        "start_line": 28,
+        "end_line": 28
+      },
+      "evidence": [
+        {
+          "file": "dotnet-legacy/Web/Controllers/InvoiceController.cs",
+          "line": 28,
+          "code": "var list = db.Database.SqlQuery<Invoice>(\"SELECT * FROM Invoices WHERE Customer = '\" + customer + \"'\").ToList();",
+          "why": "Unsanitized POST parameter 'customer' concatenated into query"
+        }
+      ],
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "recommendation": "Use parameterized queries",
+      "status": "unverified",
+      "fingerprint": "kfp1:81106c3dfe7181ee5aad08bbd8e6c94143e8ebb6bf477a18828ca399339d1271",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "INJ-I-0009-1",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in dotnet-legacy/Web/Orders/EditOrder.aspx.vb:7",
+      "candidate_id": "I-0009",
+      "location": {
+        "file": "dotnet-legacy/Web/Orders/EditOrder.aspx.vb",
+        "start_line": 7
+      },
+      "evidence": [
+        {
+          "file": "dotnet-legacy/Web/Orders/EditOrder.aspx.vb",
+          "start_line": 7,
+          "code": "Dim sql As String = \"UPDATE Orders SET Note = '\" & txtNote.Text & \"'\"",
+          "why": "Unsanitized txtNote.Text concatenated into query",
+          "line": 7
+        },
+        {
+          "file": "dotnet-legacy/Web/Orders/EditOrder.aspx.vb",
+          "start_line": 8,
+          "code": "sql &= \" WHERE OrderId = \" & hfOrderId.Value",
+          "why": "Unsanitized hfOrderId.Value concatenated into query",
+          "line": 8
+        },
+        {
+          "file": "dotnet-legacy/Web/Orders/EditOrder.aspx.vb",
+          "start_line": 10,
+          "code": "Dim cmd As New SqlCommand(sql, conn)",
+          "why": "Query executed without parameters",
+          "line": 10
+        }
+      ],
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "recommendation": "Use parameterized SqlCommand",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "dotnet-legacy/Web/Orders/EditOrder.aspx.vb lines 7-10",
+          "no parameterised SqlCommand or input validation on txtNote.Text or hfOrderId.Value"
+        ],
+        "control_found": null,
+        "notes": "The VB code concatenates user input into an UPDATE statement without parameters or validation.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Unsanitised string concatenation into SQL."
+      },
+      "fingerprint": "kfp1:999e755f32c1edc6b46f7497ebdfd065d8afcc3518cab3211f45fc11a7342afd",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "INJ-I-0011-1",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in dotnet-legacy/Web/Orders/OrderDetail.aspx.cs:13",
+      "candidate_id": "I-0011",
+      "location": {
+        "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+        "start_line": 13
+      },
+      "evidence": [
+        {
+          "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+          "start_line": 13,
+          "code": "var cmd = new SqlCommand(\"SELECT * FROM Orders WHERE OrderId = \" + id, conn);",
+          "why": "Unsanitized id concatenated into query",
+          "line": 13
+        },
+        {
+          "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+          "start_line": 19,
+          "code": "string sql2 = string.Format(\"SELECT * FROM Logs WHERE Ref = '{0}'\", Request[\"ref\"]);",
+          "why": "Unsanitized Request[\"ref\"] concatenated into query",
+          "line": 19
+        },
+        {
+          "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+          "start_line": 20,
+          "code": "string sql3 = $\"DELETE FROM Carts WHERE CartId = {Request.Form[\"cart\"]}\";",
+          "why": "Unsanitized Request.Form[\"cart\"] concatenated into query",
+          "line": 20
+        }
+      ],
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "recommendation": "Use parameterized queries for all statements",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs lines 13, 19, 20",
+          "no parameterised SqlCommand or input validation on id, Request[\"ref\"], Request.Form[\"cart\"]"
+        ],
+        "control_found": null,
+        "notes": "All three statements concatenate user input directly into SQL/HQL without parameters.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Direct concatenation of user input into SQL/HQL."
+      },
+      "fingerprint": "kfp1:c9aa426f72d032a9b0729b0905c9c25a6fb8844a92a91c45d72d3e26170bbae5",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "INJ-I-0014-1",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in java-legacy/WebContent/order/detail.jsp:5",
+      "candidate_id": "I-0014",
+      "location": {
+        "file": "java-legacy/WebContent/order/detail.jsp",
+        "start_line": 5
+      },
+      "evidence": [
+        {
+          "file": "java-legacy/WebContent/order/detail.jsp",
+          "start_line": 5,
+          "code": "ResultSet rs = c.createStatement().executeQuery(\"SELECT * FROM orders WHERE order_no = '\" + no + \"'\");",
+          "why": "Unsanitized no concatenated into query",
+          "line": 5
+        }
+      ],
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "recommendation": "Use PreparedStatement with parameters",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "java-legacy/WebContent/order/detail.jsp line 5",
+          "no PreparedStatement or input validation on no"
+        ],
+        "control_found": null,
+        "notes": "The JSP concatenates the request parameter no directly into a SQL query.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Unsanitised string concatenation into SQL."
+      },
+      "fingerprint": "kfp1:b8e7acb1ca7119156e96cf2bd42356b53bb6107a0a904b492534714730ac45f8",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "INJ-I-0015",
+      "category": "sql_injection",
+      "subtype": "dynamic_identifier",
+      "title": "SQL Injection in java-legacy/src/com/acme/mapper/OrderMapper.xml:9",
+      "candidate_id": "I-0015",
+      "location": {
+        "file": "java-legacy/src/com/acme/mapper/OrderMapper.xml",
+        "start_line": 9,
+        "end_line": 9
+      },
+      "evidence": [
+        {
+          "file": "java-legacy/src/com/acme/mapper/OrderMapper.xml",
+          "line": 9,
+          "code": "ORDER BY ${orderBy}",
+          "why": "Dynamic identifier ${orderBy} inserted without validation"
+        }
+      ],
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "recommendation": "Validate orderBy against an allow‑list or use parameter binding",
+      "status": "unverified",
+      "fingerprint": "kfp1:a0212ab67bd8e95a9fa71520fd15ba101852184637a1a60ec1bb91525308964f",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "INJ-I-0016-1",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in java-legacy/src/com/acme/struts/EditUserAction.java:13",
+      "candidate_id": "I-0016",
+      "location": {
+        "file": "java-legacy/src/com/acme/struts/EditUserAction.java",
+        "start_line": 13
+      },
+      "evidence": [
+        {
+          "file": "java-legacy/src/com/acme/struts/EditUserAction.java",
+          "start_line": 13,
+          "code": "PreparedStatement ps = conn.prepareStatement(\"UPDATE users SET email = '\" + email + \"' WHERE id = \" + userId);",
+          "why": "Unsanitized email and userId concatenated into query",
+          "line": 13
+        }
+      ],
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "recommendation": "Use parameterized PreparedStatement",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "java-legacy/src/com/acme/struts/EditUserAction.java line 13",
+          "no PreparedStatement parameters used for email or userId"
+        ],
+        "control_found": null,
+        "notes": "The code builds an UPDATE statement by concatenating user input directly.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Direct string concatenation of user input into SQL."
+      },
+      "fingerprint": "kfp1:2976fb21c23c927d1de0f3af7dc883d9b66a1d051ec67bb9ec1b44396f6479fc",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "INJ-I-0017-1",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in java-legacy/src/com/acme/web/InvoiceController.java:29",
+      "candidate_id": "I-0017",
+      "location": {
+        "file": "java-legacy/src/com/acme/web/InvoiceController.java",
+        "start_line": 29
+      },
+      "evidence": [
+        {
+          "file": "java-legacy/src/com/acme/web/InvoiceController.java",
+          "start_line": 29,
+          "code": "model.addAttribute(\"list\", session.createQuery(\"from Invoice i where i.customer = '\" + customer + \"'\").list());",
+          "why": "Unsanitized customer concatenated into HQL query",
+          "line": 29
+        }
+      ],
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "recommendation": "Use parameterized HQL/JPQL",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "java-legacy/src/com/acme/web/InvoiceController.java line 29",
+          "no parameterised HQL or input validation on customer"
+        ],
+        "control_found": null,
+        "notes": "The HQL query concatenates the customer value directly, enabling injection.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Unsanitised concatenation into HQL."
+      },
+      "fingerprint": "kfp1:7796f734194bfe71dc7268f597efd6338a4e967a788e0220edb61b8e1c198b16",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "INJ-I-0018",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in java-legacy/src/com/acme/web/OrderServlet.java:15",
+      "candidate_id": "I-0018",
+      "location": {
+        "file": "java-legacy/src/com/acme/web/OrderServlet.java",
+        "start_line": 15,
+        "end_line": 15
+      },
+      "evidence": [
+        {
+          "file": "java-legacy/src/com/acme/web/OrderServlet.java",
+          "line": 15,
+          "code": "ResultSet rs = stmt.executeQuery(\"SELECT * FROM orders WHERE id = '\" + id + \"'\");",
+          "why": "Unsanitized request parameter 'id' concatenated into query"
+        }
+      ],
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "recommendation": "Use prepared statements",
+      "status": "unverified",
+      "fingerprint": "kfp1:eed713c040fe4b03f16a649b4da2fa326995fd074ad3ba46bbbb4958486b6b8d",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "INJ-I-0020-1",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in node-express/routes/orders.js:17",
+      "candidate_id": "I-0020",
+      "location": {
+        "file": "node-express/routes/orders.js",
+        "start_line": 17
+      },
+      "evidence": [
+        {
+          "file": "node-express/routes/orders.js",
+          "start_line": 17,
+          "code": "db.query(\"SELECT * FROM reports WHERE month = '\" + req.query.month + \"'\", function (e, rows) { res.json(rows); });",
+          "why": "Unsanitized req.query.month concatenated into SQL",
+          "line": 17
+        }
+      ],
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "recommendation": "Use parameterized queries or escape input",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "node-express/routes/orders.js:17"
+        ],
+        "control_found": null,
+        "notes": "The query concatenates the raw req.query.month value directly into the SQL string. No integer cast, parameter binding, or whitelist is applied to this variable in the repository. The surrounding code does not perform any sanitization or ownership checks, so the vulnerability remains.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "No compensating control found; the raw query parameter is used unsafely."
+      },
+      "fingerprint": "kfp1:fc0f31011ca4510d026845f7fb0dcd77812ef24f6ea5329ad24fbc08a15b58ff",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "INJ-I-0021-1",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in node-express/routes/orders.js:29",
+      "candidate_id": "I-0021",
+      "location": {
+        "file": "node-express/routes/orders.js",
+        "start_line": 29
+      },
+      "evidence": [
+        {
+          "file": "node-express/routes/orders.js",
+          "start_line": 29,
+          "code": "db.query(`SELECT COUNT(*) AS n FROM orders WHERE shop_id = ${req.query.shop}`, function (e, r) { res.json(r); });",
+          "why": "Unsanitized req.query.shop concatenated into SQL",
+          "line": 29
+        }
+      ],
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "recommendation": "Use parameterized queries",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "node-express/routes/orders.js:29"
+        ],
+        "control_found": null,
+        "notes": "The shop_id value from req.query.shop is interpolated directly into the SQL string via a template literal. There is no cast to integer, no parameterized query, and no whitelist for shop identifiers. The code path is reachable from HTTP requests, so the injection risk is present.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Direct string interpolation without sanitization."
+      },
+      "fingerprint": "kfp1:5fef20fe2b97718add08c2ce704c057931ba2f5b5f9277493213205e35d8fde8",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "INJ-I-0022-1",
+      "category": "sql_injection",
+      "subtype": "operator_injection",
+      "title": "NoSQL Injection in node-express/routes/orders.js:21",
+      "candidate_id": "I-0022",
+      "location": {
+        "file": "node-express/routes/orders.js",
+        "start_line": 21
+      },
+      "evidence": [
+        {
+          "file": "node-express/routes/orders.js",
+          "start_line": 21,
+          "code": "db.collection('users').findOne(req.body, function (e, u) { res.json(!!u); });",
+          "why": "Unvalidated request body used directly as MongoDB filter",
+          "line": 21
+        }
+      ],
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "recommendation": "Validate and sanitize request body before using as query",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "node-express/routes/orders.js:21"
+        ],
+        "control_found": null,
+        "notes": "The request body is passed directly to MongoDB's findOne without validation or sanitization. No allow‑list or type enforcement is applied, exposing the application to NoSQL injection.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Unvalidated body used as query filter."
+      },
+      "fingerprint": "kfp1:df07d4b13c0cb50ad0e152d7237b34cd480621efb4230a602262b9a093401839",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "INJ-I-0023-1",
+      "category": "sql_injection",
+      "subtype": "operator_injection",
+      "title": "NoSQL Injection in node-express/routes/orders.js:25",
+      "candidate_id": "I-0023",
+      "location": {
+        "file": "node-express/routes/orders.js",
+        "start_line": 25
+      },
+      "evidence": [
+        {
+          "file": "node-express/routes/orders.js",
+          "start_line": 25,
+          "code": "db.collection('items').find({ $where: \"this.name == '\" + req.query.n + \"'\" }).toArray(function (e, r) { res.json(r); });",
+          "why": "Unsanitized req.query.n concatenated into $where string",
+          "line": 25
+        }
+      ],
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "recommendation": "Avoid $where or escape input",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "node-express/routes/orders.js:25"
+        ],
+        "control_found": null,
+        "notes": "The $where string concatenates req.query.n directly, allowing arbitrary JavaScript execution in MongoDB. No whitelist or escaping is performed, so the injection remains.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Unsanitized $where clause."
+      },
+      "fingerprint": "kfp1:4adb02f62f3a6cc025b5f6a8cf67256c58ba026d3816f1d2e41944cd97d25ed5",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "INJ-I-0024-1",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in perl-cgi/cgi-bin/order.cgi:13",
+      "candidate_id": "I-0024",
+      "location": {
+        "file": "perl-cgi/cgi-bin/order.cgi",
+        "start_line": 13
+      },
+      "evidence": [
+        {
+          "file": "perl-cgi/cgi-bin/order.cgi",
+          "start_line": 13,
+          "code": "$dbh->prepare(\"SELECT * FROM orders WHERE id = $id\");",
+          "why": "Unsanitized id concatenated into query",
+          "line": 13
+        }
+      ],
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "recommendation": "Use placeholders and bind parameters",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "perl-cgi/cgi-bin/order.cgi:13"
+        ],
+        "control_found": null,
+        "notes": "The $id variable is interpolated directly into the SQL string. There is no explicit integer cast or parameter binding in the surrounding code, so the query is vulnerable to injection.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Direct interpolation without sanitization."
+      },
+      "fingerprint": "kfp1:0594761f603533b7391a9b7a8464e6865b71c1b61b71fdcd10991d861f51b5fb",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "INJ-I-0025-1",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in perl-cgi/cgi-bin/order.cgi:19",
+      "candidate_id": "I-0025",
+      "location": {
+        "file": "perl-cgi/cgi-bin/order.cgi",
+        "start_line": 19
+      },
+      "evidence": [
+        {
+          "file": "perl-cgi/cgi-bin/order.cgi",
+          "start_line": 19,
+          "code": "$dbh->do(\"DELETE FROM carts WHERE cart_id = \" . $q->param('cart'));",
+          "why": "Unsanitized cart id concatenated into query",
+          "line": 19
+        }
+      ],
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "recommendation": "Use placeholders and bind parameters",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "perl-cgi/cgi-bin/order.cgi:19"
+        ],
+        "control_found": null,
+        "notes": "The cart_id value from the CGI parameter is concatenated into the DELETE statement without casting or escaping. No compensating control is present.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Unsanitized parameter in SQL."
+      },
+      "fingerprint": "kfp1:c7206e5510c18d43418b9ed9a4d20047783ea5263cfdc395a138b735b613debc",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "INJ-I-0026",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in php-codeigniter/application/controllers/Invoice.php:10",
+      "candidate_id": "I-0026",
+      "location": {
+        "file": "php-codeigniter/application/controllers/Invoice.php",
+        "start_line": 10,
+        "end_line": 10
+      },
+      "evidence": [
+        {
+          "file": "php-codeigniter/application/controllers/Invoice.php",
+          "line": 10,
+          "code": "$q = $this->db->query(\"SELECT * FROM invoices WHERE id = $id\");",
+          "why": "Unsanitized method parameter 'id' concatenated into query"
+        }
+      ],
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "recommendation": "Use parameterized queries",
+      "status": "unverified",
+      "fingerprint": "kfp1:cab7179a42b52f77a862191152d4b0ebc8511c6c77b956503f7c53525c9390b0",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "INJ-I-0028-1",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in php-plain/admin.php:12",
+      "candidate_id": "I-0028",
+      "location": {
+        "file": "php-plain/admin.php",
+        "start_line": 12
+      },
+      "evidence": [
+        {
+          "file": "php-plain/admin.php",
+          "start_line": 12,
+          "code": "mysql_query(\"DELETE FROM users WHERE id = $id\");",
+          "why": "Unsanitized id concatenated into query",
+          "line": 12
+        }
+      ],
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "recommendation": "Use parameterized queries or cast to int",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "php-plain/admin.php:12"
+        ],
+        "control_found": null,
+        "notes": "The $id variable is interpolated directly into the DELETE query. No type casting or parameterization is applied, leaving the statement vulnerable.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Direct string interpolation."
+      },
+      "fingerprint": "kfp1:59fca8cd0dedd8f70d286a5d3808292d9eddcf084148a63a448b7043b69c7948",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "INJ-I-0030-1",
+      "category": "sql_injection",
+      "subtype": "operator_injection",
+      "title": "NoSQL Injection in php-plain/mongo_find.php:6",
+      "candidate_id": "I-0030",
+      "location": {
+        "file": "php-plain/mongo_find.php",
+        "start_line": 6
+      },
+      "evidence": [
+        {
+          "file": "php-plain/mongo_find.php",
+          "start_line": 6,
+          "code": "$docs = $coll->find(array('$where' => \"this.name == '\" . $_GET['n'] . \"'\"));",
+          "why": "Unsanitized $_GET['n'] concatenated into $where string",
+          "line": 6
+        }
+      ],
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "recommendation": "Avoid $where or escape input",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "php-plain/mongo_find.php:6"
+        ],
+        "control_found": null,
+        "notes": "The $_GET['n'] value is concatenated into a $where string without escaping or validation, exposing the application to NoSQL injection.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Unsanitized $where clause."
+      },
+      "fingerprint": "kfp1:c00da5eade29da19cd3a2748fe31b7779bdc4fb7084502d0a108f2bd593e87ad",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "INJ-I-0031",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in php-plain/order_detail.php:6",
+      "candidate_id": "I-0031",
+      "location": {
+        "file": "php-plain/order_detail.php",
+        "start_line": 6,
+        "end_line": 6
+      },
+      "evidence": [
+        {
+          "file": "php-plain/order_detail.php",
+          "line": 6,
+          "code": "$res = mysql_query(\"SELECT * FROM orders WHERE id = \" . $id);",
+          "why": "Unsanitized GET id concatenated into query"
+        }
+      ],
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "recommendation": "Use parameterized queries",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "php-plain/order_detail.php:6"
+        ],
+        "control_found": null,
+        "notes": "The $id variable is concatenated directly into the SELECT statement. No integer cast or parameter binding is performed, so the query is vulnerable.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Direct interpolation without sanitization."
+      },
+      "fingerprint": "kfp1:3065614ddeff53f64ce73f2bd0210f5b36a2249f4d2561f69219095ad867ac9f",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "INJ-I-0032",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in php-plain/search.php:8",
+      "candidate_id": "I-0032",
+      "location": {
+        "file": "php-plain/search.php",
+        "start_line": 8,
+        "end_line": 8
+      },
+      "evidence": [
+        {
+          "file": "php-plain/search.php",
+          "line": 8,
+          "code": "$sql .= \" AND name LIKE '%\" . $kw . \"%'\";",
+          "why": "Unsanitized $kw (addslashes is not sufficient) concatenated into LIKE clause"
+        }
+      ],
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "recommendation": "Use parameterized queries",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "php-plain/search.php:8"
+        ],
+        "control_found": null,
+        "notes": "The $kw variable is concatenated into a LIKE clause without escaping or parameterization. The use of addslashes is insufficient, leaving the query susceptible to injection.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Unsanitized LIKE clause."
+      },
+      "fingerprint": "kfp1:7290ec7c22df15c86f213eb1e27320eaf80f4bafc68a9a6813fb0bd32771b6da",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "INJ-I-0033",
+      "category": "sql_injection",
+      "subtype": "dynamic_identifier",
+      "title": "SQL Injection in php-plain/search.php:9",
+      "candidate_id": "I-0033",
+      "location": {
+        "file": "php-plain/search.php",
+        "start_line": 9,
+        "end_line": 9
+      },
+      "evidence": [
+        {
+          "file": "php-plain/search.php",
+          "line": 9,
+          "code": "$sql .= \" ORDER BY \" . $sort;",
+          "why": "Unsanitized $sort used as ORDER BY column"
+        }
+      ],
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "recommendation": "Validate against an allow‑list or use parameter binding",
+      "status": "unverified",
+      "fingerprint": "kfp1:8871b7f21b190efe0d95ac0274808695c3b37ac2eb4a505a8916f71d8dfb8d80",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "INJ-I-0034",
+      "category": "sql_injection",
+      "subtype": "string_concatenation",
+      "title": "SQL Injection in php-plain/search.php:14",
+      "candidate_id": "I-0034",
+      "location": {
+        "file": "php-plain/search.php",
+        "start_line": 14,
+        "end_line": 14
+      },
+      "evidence": [
+        {
+          "file": "php-plain/search.php",
+          "line": 14,
+          "code": "$q = <<<SQL\nSELECT * FROM products\nWHERE category = '{$_GET['cat']}'\nSQL;",
+          "why": "Unsanitized $_GET['cat'] interpolated into query"
+        }
+      ],
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "recommendation": "Use parameterized queries",
+      "status": "unverified",
+      "fingerprint": "kfp1:59c91493f8e83065ed0bab7d82438a17443ae7ba9bc82c1659053686f63083d7",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "INJ-I-0036",
+      "category": "sql_injection",
+      "subtype": "string_interpolation",
+      "title": "SQL Injection in python-flask/app.py:29",
+      "candidate_id": "I-0036",
+      "location": {
+        "file": "python-flask/app.py",
+        "start_line": 29,
+        "end_line": 29
+      },
+      "evidence": [
+        {
+          "file": "python-flask/app.py",
+          "line": 29,
+          "code": "cur.execute(f\"SELECT * FROM products WHERE name LIKE '%{q}%'\")",
+          "why": "Unsanitized f-string interpolates user input directly into SQL"
+        }
+      ],
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "recommendation": "Use parameterized queries",
+      "status": "unverified",
+      "fingerprint": "kfp1:52c1a1b2beb4129f6fbbfa5c9bcc2f05de1cb6b4a835dcb6adfa7075c03edf79",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "INJ-I-0037",
+      "category": "sql_injection",
+      "subtype": "stored_procedure_dynamic_sql",
+      "title": "SQL Injection in sql-procs/sp_search_orders.sql:5",
+      "candidate_id": "I-0037",
+      "location": {
+        "file": "sql-procs/sp_search_orders.sql",
+        "start_line": 5,
+        "end_line": 5
+      },
+      "evidence": [
+        {
+          "file": "sql-procs/sp_search_orders.sql",
+          "line": 5,
+          "code": "SET @sql = 'SELECT * FROM Orders WHERE Customer = ''' + @Customer + ''' ORDER BY ' + @Sort",
+          "why": "Dynamic SQL built from user‑supplied parameters @Customer and @Sort"
+        }
+      ],
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-89"
+      ],
+      "recommendation": "Avoid dynamic SQL or validate parameters against an allow‑list",
+      "status": "unverified",
+      "fingerprint": "kfp1:dda6a5bb147b8aa741739e9da8799b0f942492567758d5d3209c1395a97c8f98",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "MASS-M-0006-1",
+      "category": "mass_assignment",
+      "subtype": "whole_object_binding",
+      "title": "Profile update binds entire request body to User model",
+      "route_id": null,
+      "candidate_id": "M-0006",
+      "location": {
+        "file": "routes/user.js",
+        "start_line": 8
+      },
+      "evidence": [
+        {
+          "file": "routes/user.js",
+          "line": 8,
+          "why": "User.findByIdAndUpdate(req.user._id, req.body) binds the entire request body to the User model without an allowlist."
+        }
+      ],
+      "impact": "Privilege escalation via role field",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Limit fields to an allowlist; set privileged fields server‑side.",
+      "status": "unverified",
+      "attack_vector": {
+        "method": "PUT",
+        "path": "/profile",
+        "fields": {
+          "role": "admin"
+        },
+        "readback": "GET /profile"
+      },
+      "fingerprint": "kfp1:282f5e8be1631c7b03fed9bf57993ef10563c39925ef41f9be43c7a2213948c4",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "MASS-M-0011-1",
+      "category": "mass_assignment",
+      "subtype": "whole_object_binding",
+      "title": "Unrestricted binding of all POST fields to User in PHP profile.php",
+      "candidate_id": "M-0011",
+      "location": {
+        "file": "php-plain/profile.php",
+        "start_line": 5
+      },
+      "evidence": [
+        {
+          "file": "php-plain/profile.php",
+          "line": 6,
+          "why": "foreach ($_POST as $field => $value) { $user->$field = $value; } – whole object binding"
+        },
+        {
+          "file": "php-plain/profile.php",
+          "line": 10,
+          "why": "privileged field 'role' is written from request"
+        }
+      ],
+      "impact": "Any user can set their own role to admin",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Copy only allowed fields (e.g., nickname) from the request and ignore role",
+      "status": "unverified",
+      "fingerprint": "kfp1:4042bba4357c8075f2a2bd67fdfc0cea2d5512d99de70a4395a9bfcf87b67063",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "MASS-M-0012-1",
+      "category": "mass_assignment",
+      "subtype": "privileged_field_writable",
+      "title": "Privileged field 'role' writable in PHP profile.php",
+      "candidate_id": "M-0012",
+      "location": {
+        "file": "php-plain/profile.php",
+        "start_line": 5
+      },
+      "evidence": [
+        {
+          "file": "php-plain/profile.php",
+          "line": 10,
+          "why": "writes $_POST['role'] to user object – privileged field writable"
+        }
+      ],
+      "impact": "Any user can set their own role to admin",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Remove role from the list of fields that can be updated by the user",
+      "status": "unverified",
+      "fingerprint": "kfp1:c0564ee6e15360b75abcad854b22f5c063ad4eb320bd9ce0a4c47e3b7e483d2b",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "MASS-M-0014-1",
+      "category": "mass_assignment",
+      "subtype": "whole_object_binding",
+      "title": "Create user binds entire request body to User model",
+      "route_id": null,
+      "candidate_id": "M-0014",
+      "location": {
+        "file": "app.py",
+        "start_line": 10
+      },
+      "evidence": [
+        {
+          "file": "app.py",
+          "line": 10,
+          "why": "User(**request.json) binds the entire request body to the User model without an allowlist."
+        }
+      ],
+      "impact": "Privilege escalation via role field",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Limit fields to an allowlist; set privileged fields server‑side.",
+      "status": "confirmed",
+      "attack_vector": {
+        "method": "POST",
+        "path": "/users",
+        "fields": {
+          "role": "admin"
+        },
+        "readback": "GET /users/123"
+      },
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "app.py line 10-12: create_user() constructs User(**request.json) which forwards all JSON keys to the model constructor."
+        ],
+        "control_found": null,
+        "notes": "The User model’s __init__ accepts **kwargs and assigns them to attributes without restriction, allowing the attacker to set privileged fields such as 'role'.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "The constructor accepts arbitrary keyword arguments, confirming the vulnerability."
+      },
+      "fingerprint": "kfp1:ce4a5edbc11d47f0e7f1c8880eb0c744ee98ee0f2834696e9ac8642ee6281773",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "MASS-M-0015-1",
+      "category": "mass_assignment",
+      "subtype": "whole_object_binding",
+      "title": "PATCH user updates binds arbitrary fields to User model",
+      "route_id": null,
+      "candidate_id": "M-0015",
+      "location": {
+        "file": "app.py",
+        "start_line": 27
+      },
+      "evidence": [
+        {
+          "file": "app.py",
+          "line": 27,
+          "why": "Loop over request.json items and set attributes on user; no allowlist."
+        }
+      ],
+      "impact": "Privilege escalation via role field",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Limit fields to an allowlist; set privileged fields server‑side.",
+      "status": "confirmed",
+      "attack_vector": {
+        "method": "PATCH",
+        "path": "/users/123",
+        "fields": {
+          "role": "admin"
+        },
+        "readback": "GET /users/123"
+      },
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "app.py line 27-30: update_user() loops over request.json and sets attributes via setattr(user, key, value)."
+        ],
+        "control_found": null,
+        "notes": "No allow‑list or validation is applied before setting attributes. The loop permits arbitrary fields, including 'role', to be written to the User instance, enabling privilege escalation.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "The code directly assigns request data to the model without filtering, confirming the vulnerability."
+      },
+      "fingerprint": "kfp1:2b45c26cb0e79c67cde4ca5fd3bda885bdbc5af1c02aab97781ca4656b950580",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BOLA-R-0001",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in ANY /user/edit.do: missing owner verification",
+      "route_id": "R-0001",
+      "endpoint": {
+        "method": "ANY",
+        "path": "/user/edit.do"
+      },
+      "location": {
+        "file": "java-legacy/src/com/acme/struts/EditUserAction.java",
+        "start_line": 10
+      },
+      "evidence": [
+        {
+          "file": "java-legacy/src/com/acme/struts/EditUserAction.java",
+          "start_line": 10,
+          "code": "String userId = request.getParameter(\"user_id\");",
+          "why": "ID comes from the request; attacker can supply any user_id",
+          "line": 10
+        },
+        {
+          "file": "java-legacy/src/com/acme/struts/EditUserAction.java",
+          "start_line": 13,
+          "code": "PreparedStatement ps = conn.prepareStatement(\"UPDATE users SET email = '\" + email + \"' WHERE id = \" + userId);",
+          "why": "SQL uses the attacker‑supplied user_id without checking ownership",
+          "line": 13
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Bind the update to the current session user",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "java-legacy/src/com/acme/struts/EditUserAction.java lines 10‑13",
+          "global Struts interceptor configuration (no ownership interceptor found)",
+          "session validation in GlobalFilter (none present)"
+        ],
+        "control_found": null,
+        "notes": "The action reads the user_id from the request and interpolates it directly into an UPDATE statement without any ownership check, sanitization, or integer casting. No global filter or interceptor enforces ownership or limits the id to the logged‑in user.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Independent audit found no compensating control; the request parameter is used unsafely."
+      },
+      "fingerprint": "kfp1:fd2aa0a34a547de1965d6735e927f0eb2dac3c019cdf1e1d14bdfa9666ae1581",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BOLA-R-0002",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in ANY /classic-asp/shop/member.asp?mode=edit: missing owner verification",
+      "route_id": "R-0002",
+      "endpoint": {
+        "method": "ANY",
+        "path": "/classic-asp/shop/member.asp?mode=edit"
+      },
+      "location": {
+        "file": "classic-asp/shop/member.asp",
+        "start_line": 6
+      },
+      "evidence": [
+        {
+          "file": "classic-asp/shop/member.asp",
+          "start_line": 6,
+          "code": "sql = \"UPDATE members SET name = '\" & Replace(Request.Form(\"name\"), \"'\", \"''\") & \"'\"",
+          "why": "SQL string built from request data",
+          "line": 6
+        },
+        {
+          "file": "classic-asp/shop/member.asp",
+          "start_line": 7,
+          "code": "sql = sql & \" WHERE member_id = \" & Request.Form(\"member_id\")",
+          "why": "member_id comes from the request; no ownership check",
+          "line": 7
+        },
+        {
+          "file": "classic-asp/shop/member.asp",
+          "start_line": 8,
+          "code": "conn.Execute sql",
+          "why": "Executes the unbound query",
+          "line": 8
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Add an ownership check to the UPDATE statement",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "classic-asp/shop/member.asp lines 6‑8",
+          "global include files (no ownership check found)",
+          "session validation in classic‑asp (none present)"
+        ],
+        "control_found": null,
+        "notes": "The ASP code builds an UPDATE query using Request.Form(\"member_id\") directly. No sanitization, casting, or ownership verification is performed, and no global filter or session guard is present.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "No compensating control detected; the identifier is used unsafely."
+      },
+      "fingerprint": "kfp1:99af1eeee9810e226e1e9087abed7ad8883a9cb6e96fcb50fdcd281bc652e4bd",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BOLA-R-0003",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in ANY /classic-asp/shop/member.asp?mode=delete: missing owner verification",
+      "route_id": "R-0003",
+      "endpoint": {
+        "method": "ANY",
+        "path": "/classic-asp/shop/member.asp?mode=delete"
+      },
+      "location": {
+        "file": "classic-asp/shop/member.asp",
+        "start_line": 9
+      },
+      "evidence": [
+        {
+          "file": "classic-asp/shop/member.asp",
+          "start_line": 9,
+          "code": "Case \"delete\"",
+          "why": "Delete branch",
+          "line": 9
+        },
+        {
+          "file": "classic-asp/shop/member.asp",
+          "start_line": 10,
+          "code": "conn.Execute \"DELETE FROM members WHERE member_id = \" & Request.QueryString(\"member_id\")",
+          "why": "member_id comes from the request; no ownership check",
+          "line": 10
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Add an ownership check to the DELETE statement",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "classic-asp/shop/member.asp lines 9‑10",
+          "global include files (no ownership check found)",
+          "session validation in classic‑asp (none present)"
+        ],
+        "control_found": null,
+        "notes": "The DELETE statement uses Request.QueryString(\"member_id\") without any ownership check or sanitization. No global filter or session guard is present.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Direct use of the identifier without validation."
+      },
+      "fingerprint": "kfp1:29fb5a10552560ba47d892b16a1ad7a135ce2f282623ae6cc75f5074f34e83cf",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BOLA-R-0004",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in ANY /classic-asp/shop/order.asp: missing owner verification on order read",
+      "route_id": "R-0004",
+      "endpoint": {
+        "method": "ANY",
+        "path": "/classic-asp/shop/order.asp"
+      },
+      "location": {
+        "file": "classic-asp/shop/order.asp",
+        "start_line": 5
+      },
+      "evidence": [
+        {
+          "file": "classic-asp/shop/order.asp",
+          "start_line": 5,
+          "code": "id = Request(\"id\")",
+          "why": "Order id comes from the request",
+          "line": 5
+        },
+        {
+          "file": "classic-asp/shop/order.asp",
+          "start_line": 6,
+          "code": "Set rs = conn.Execute(\"SELECT * FROM orders WHERE id = \" & id)",
+          "why": "Query uses the attacker‑supplied id without ownership check",
+          "line": 6
+        },
+        {
+          "file": "classic-asp/shop/order.asp",
+          "start_line": 7,
+          "code": "Response.Write Server.HTMLEncode(rs(\"address\"))",
+          "why": "Outputs data from the unbound query",
+          "line": 7
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Bind the SELECT to the current session user",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "classic-asp/shop/order.asp lines 5‑7",
+          "global include files (no ownership check found)",
+          "session validation in classic‑asp (none present)"
+        ],
+        "control_found": null,
+        "notes": "The SELECT query concatenates Request(\"id\") directly into the SQL. No ownership verification or sanitization is performed, and no global filter is present.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Identifier used unsafely with no compensating control."
+      },
+      "fingerprint": "kfp1:e93fc6e82ca183dc55be6fef39c3146001c4dbab631322ba960d00930e254b5d",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BOLA-R-0005",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in ANY /coldfusion/app/OrderService.cfc?method=getOrder: missing owner verification",
+      "route_id": "R-0005",
+      "endpoint": {
+        "method": "ANY",
+        "path": "/coldfusion/app/OrderService.cfc?method=getOrder"
+      },
+      "location": {
+        "file": "coldfusion/app/OrderService.cfc",
+        "start_line": 4
+      },
+      "evidence": [
+        {
+          "file": "coldfusion/app/OrderService.cfc",
+          "start_line": 4,
+          "code": "<cffunction name=\"getOrder\" access=\"remote\" returnformat=\"json\">",
+          "why": "Remote function exposed to clients",
+          "line": 4
+        },
+        {
+          "file": "coldfusion/app/OrderService.cfc",
+          "start_line": 5,
+          "code": "<cfquery name=\"q\" datasource=\"shop\">",
+          "why": "Query block",
+          "line": 5
+        },
+        {
+          "file": "coldfusion/app/OrderService.cfc",
+          "start_line": 6,
+          "code": "SELECT * FROM orders WHERE id = #arguments.orderId#",
+          "why": "Uses attacker‑supplied orderId without ownership check",
+          "line": 6
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Add an ownership check to the query",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "coldfusion/app/OrderService.cfc lines 4‑6",
+          "ColdFusion security policy (remote functions allowed)",
+          "global cfinclude files (no ownership check found)"
+        ],
+        "control_found": null,
+        "notes": "The remote function getOrder interpolates arguments.orderId directly into the query. No ownership check, casting, or allow‑list is applied, and no global security policy restricts the function to the current user.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "No compensating control detected."
+      },
+      "fingerprint": "kfp1:c856936fd2eec990ab6cbc31fe4731bcb2077a14890d911f4e4369445335a26d",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BOLA-R-0006",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in ANY /coldfusion/app/order.cfm: missing owner verification on order read",
+      "route_id": "R-0006",
+      "endpoint": {
+        "method": "ANY",
+        "path": "/coldfusion/app/order.cfm"
+      },
+      "location": {
+        "file": "coldfusion/app/order.cfm",
+        "start_line": 2
+      },
+      "evidence": [
+        {
+          "file": "coldfusion/app/order.cfm",
+          "start_line": 2,
+          "code": "<cfquery name=\"qOrder\" datasource=\"shop\">",
+          "why": "Query block",
+          "line": 2
+        },
+        {
+          "file": "coldfusion/app/order.cfm",
+          "start_line": 3,
+          "code": "SELECT * FROM orders WHERE id = #url.id#",
+          "why": "Uses attacker‑supplied id without ownership check",
+          "line": 3
+        },
+        {
+          "file": "coldfusion/app/order.cfm",
+          "start_line": 10,
+          "code": "<cfoutput>#qOrder.address#</cfoutput>",
+          "why": "Outputs data from the unbound query",
+          "line": 10
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Bind the SELECT to the current session user",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "coldfusion/app/order.cfm lines 2‑10",
+          "ColdFusion security policy (remote access allowed)",
+          "global cfinclude files (no ownership check found)"
+        ],
+        "control_found": null,
+        "notes": "The query uses #url.id# directly without any ownership verification or sanitization. No global filter or session guard is present.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Identifier used unsafely with no compensating control."
+      },
+      "fingerprint": "kfp1:eb3e24aeaf1e9815041914c036da60526aa633ef0d70a5b2fcebfdd4a8b2309b",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BOLA-R-0007",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in POST /Admin/DeleteUser: missing owner verification",
+      "route_id": "R-0007",
+      "endpoint": {
+        "method": "POST",
+        "path": "/Admin/DeleteUser"
+      },
+      "location": {
+        "file": "dotnet-legacy/Web/Controllers/AdminController.cs",
+        "start_line": 12
+      },
+      "evidence": [
+        {
+          "file": "dotnet-legacy/Web/Controllers/AdminController.cs",
+          "start_line": 12,
+          "code": "var u = db.Users.Find(id);",
+          "why": "Finds user by id supplied in the request",
+          "line": 12
+        },
+        {
+          "file": "dotnet-legacy/Web/Controllers/AdminController.cs",
+          "start_line": 14,
+          "code": "db.Users.Remove(u);",
+          "why": "Deletes the user without checking ownership",
+          "line": 14
+        },
+        {
+          "file": "dotnet-legacy/Web/Controllers/AdminController.cs",
+          "start_line": 15,
+          "code": "db.SaveChanges();",
+          "why": "Commits the deletion",
+          "line": 15
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Restrict deletion to admins or add ownership check",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "dotnet-legacy/Web/Controllers/AdminController.cs lines 12‑15",
+          "Global filter configuration (no [Authorize] attribute on AdminController)",
+          "Session validation (only authentication, no role check)"
+        ],
+        "control_found": null,
+        "notes": "The DeleteUser action retrieves a user by id from the request and deletes it without any ownership check. No [Authorize] or role restriction is applied to the controller or action, so any authenticated user can delete any user.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "No compensating control; the action is vulnerable."
+      },
+      "fingerprint": "kfp1:ff7ce7baa2540985e6cf2198bc15a646ece40603a915b3ccbe7e0fb05ccca5d7",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BOLA-R-0009",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in ANY /Admin/Export: missing owner verification",
+      "route_id": "R-0009",
+      "endpoint": {
+        "method": "ANY",
+        "path": "/Admin/Export"
+      },
+      "location": {
+        "file": "dotnet-legacy/Web/Controllers/AdminController.cs",
+        "start_line": 32
+      },
+      "evidence": [
+        {
+          "file": "dotnet-legacy/Web/Controllers/AdminController.cs",
+          "start_line": 32,
+          "code": "if (Request.QueryString[\"isAdmin\"] == \"true\")",
+          "why": "Allows any authenticated user to set isAdmin=true",
+          "line": 32
+        },
+        {
+          "file": "dotnet-legacy/Web/Controllers/AdminController.cs",
+          "start_line": 34,
+          "code": "return Json(db.Users.ToList(), JsonRequestBehavior.AllowGet);",
+          "why": "Returns all users without ownership check",
+          "line": 34
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Remove the isAdmin query string and enforce admin role",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "dotnet-legacy/Web/Controllers/AdminController.cs lines 32‑34",
+          "Global filter configuration (no [Authorize] attribute on AdminController)",
+          "Session validation (only authentication, no role check)"
+        ],
+        "control_found": null,
+        "notes": "The Export action checks a query string parameter isAdmin and returns all users if true. No ownership check or role enforcement is present, making the endpoint vulnerable to privilege escalation.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "No compensating control; the endpoint is insecure."
+      },
+      "fingerprint": "kfp1:90078c439bd27aeab889e0707674ba50629733ab91ffef7dffb8a323e80779b3",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BOLA-R-0010",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in POST /Customer/Edit: missing owner verification",
+      "route_id": "R-0010",
+      "endpoint": {
+        "method": "POST",
+        "path": "/Customer/Edit"
+      },
+      "location": {
+        "file": "dotnet-legacy/Web/Controllers/CustomerController.cs",
+        "start_line": 12
+      },
+      "evidence": [
+        {
+          "file": "dotnet-legacy/Web/Controllers/CustomerController.cs",
+          "start_line": 12,
+          "code": "public ActionResult Edit(Customer customer)",
+          "why": "The Customer object is bound directly from the request and contains an Id that can be set by the caller.",
+          "line": 12
+        },
+        {
+          "file": "dotnet-legacy/Web/Controllers/CustomerController.cs",
+          "start_line": 14,
+          "code": "db.Entry(customer).State = System.Data.Entity.EntityState.Modified;",
+          "why": "The entity is marked modified without verifying that the Id belongs to the logged‑in user.",
+          "line": 14
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-639",
+        "CWE-284"
+      ],
+      "recommendation": "Load the customer by Id and compare its owner to the current user before applying changes.",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "dotnet-legacy/Web/Controllers/CustomerController.cs (lines 1‑20)",
+          "dotnet-legacy/Web/Controllers/CustomerController.cs [Authorize] attribute (ensures authentication only)",
+          "dotnet-legacy/Web/Controllers/CustomerController.cs no check that customer.Id matches current user"
+        ],
+        "control_found": null,
+        "notes": "The Edit action accepts a Customer object from the request and marks it modified without verifying ownership.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Authentication is enforced but ownership is not."
+      },
+      "fingerprint": "kfp1:2ff50be6396a3261e2543aa3b955d99113acdc748a014446cb0b489407bafe90",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BOLA-R-0011",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in POST /Customer/EditName: missing owner verification",
+      "route_id": "R-0011",
+      "endpoint": {
+        "method": "POST",
+        "path": "/Customer/EditName"
+      },
+      "location": {
+        "file": "dotnet-legacy/Web/Controllers/CustomerController.cs",
+        "start_line": 20
+      },
+      "evidence": [
+        {
+          "file": "dotnet-legacy/Web/Controllers/CustomerController.cs",
+          "start_line": 20,
+          "code": "public ActionResult EditName([Bind(Include = \"Id,Name\")] Customer customer)",
+          "why": "The Id is bound from the request and can be set to any customer.",
+          "line": 20
+        },
+        {
+          "file": "dotnet-legacy/Web/Controllers/CustomerController.cs",
+          "start_line": 22,
+          "code": "db.SaveChanges();",
+          "why": "No check that the Id belongs to the logged‑in user.",
+          "line": 22
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-639",
+        "CWE-284"
+      ],
+      "recommendation": "Verify ownership before saving changes.",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "dotnet-legacy/Web/Controllers/CustomerController.cs (lines 18‑26)",
+          "dotnet-legacy/Web/Controllers/CustomerController.cs [Authorize] attribute (ensures authentication only)",
+          "dotnet-legacy/Web/Controllers/CustomerController.cs no ownership check before SaveChanges"
+        ],
+        "control_found": null,
+        "notes": "The EditName action binds a Customer with Id from the request and saves it without verifying that the Id belongs to the current user.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Only authentication is enforced; ownership is missing."
+      },
+      "fingerprint": "kfp1:f8f8312969722c53dc4fbfcebddf09bfc6ea44e77f308058c6f5a0a79916c6a1",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BOLA-R-0012",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in POST /Customer/Refresh: missing owner verification",
+      "route_id": "R-0012",
+      "endpoint": {
+        "method": "POST",
+        "path": "/Customer/Refresh"
+      },
+      "location": {
+        "file": "dotnet-legacy/Web/Controllers/CustomerController.cs",
+        "start_line": 27
+      },
+      "evidence": [
+        {
+          "file": "dotnet-legacy/Web/Controllers/CustomerController.cs",
+          "start_line": 27,
+          "code": "public ActionResult Refresh(int id)",
+          "why": "The id is taken directly from the request.",
+          "line": 27
+        },
+        {
+          "file": "dotnet-legacy/Web/Controllers/CustomerController.cs",
+          "start_line": 29,
+          "code": "var customer = db.Customers.Find(id);",
+          "why": "Loads the customer without checking ownership.",
+          "line": 29
+        },
+        {
+          "file": "dotnet-legacy/Web/Controllers/CustomerController.cs",
+          "start_line": 31,
+          "code": "db.SaveChanges();",
+          "why": "Saves changes without verifying that the customer belongs to the logged‑in user.",
+          "line": 31
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-639",
+        "CWE-284"
+      ],
+      "recommendation": "Load the customer and verify ownership before updating.",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "dotnet-legacy/Web/Controllers/CustomerController.cs (lines 24‑35)",
+          "dotnet-legacy/Web/Controllers/CustomerController.cs [Authorize] attribute (ensures authentication only)",
+          "dotnet-legacy/Web/Controllers/CustomerController.cs no ownership check before SaveChanges"
+        ],
+        "control_found": null,
+        "notes": "The Refresh action loads a Customer by id from the request and saves changes without verifying ownership.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Authentication is present but ownership is not validated."
+      },
+      "fingerprint": "kfp1:642d9e00b1146b80dc8724396082e7bf839dc74fdcc9224c6452557ed7b19ab7",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BOLA-R-0013",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in ANY /Invoice/Details: missing owner verification",
+      "route_id": "R-0013",
+      "endpoint": {
+        "method": "ANY",
+        "path": "/Invoice/Details"
+      },
+      "location": {
+        "file": "dotnet-legacy/Web/Controllers/InvoiceController.cs",
+        "start_line": 11
+      },
+      "evidence": [
+        {
+          "file": "dotnet-legacy/Web/Controllers/InvoiceController.cs",
+          "start_line": 11,
+          "code": "public ActionResult Details(int id)",
+          "why": "Method receives id from request",
+          "line": 11
+        },
+        {
+          "file": "dotnet-legacy/Web/Controllers/InvoiceController.cs",
+          "start_line": 13,
+          "code": "var inv = db.Invoices.Find(id);",
+          "why": "Finds invoice by id without ownership check",
+          "line": 13
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Add ownership check to the query",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "dotnet-legacy/Web/Controllers/InvoiceController.cs lines 11‑13",
+          "Global filter configuration (no [Authorize] attribute on InvoiceController)",
+          "Session validation (only authentication, no ownership check)"
+        ],
+        "control_found": null,
+        "notes": "The Details action retrieves an invoice by id from the request without verifying that the invoice belongs to the current user. No ownership check or sanitization is performed.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Identifier used unsafely with no compensating control."
+      },
+      "fingerprint": "kfp1:a63c895e83988c707151981826dda723122bb41598834dcfa82591301c26b773",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BOLA-R-0015",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in POST /Invoice/Search: missing owner verification",
+      "route_id": "R-0015",
+      "endpoint": {
+        "method": "POST",
+        "path": "/Invoice/Search"
+      },
+      "location": {
+        "file": "dotnet-legacy/Web/Controllers/InvoiceController.cs",
+        "start_line": 26
+      },
+      "evidence": [
+        {
+          "file": "dotnet-legacy/Web/Controllers/InvoiceController.cs",
+          "start_line": 26,
+          "code": "[HttpPost]",
+          "why": "Method receives customer from request",
+          "line": 26
+        },
+        {
+          "file": "dotnet-legacy/Web/Controllers/InvoiceController.cs",
+          "start_line": 28,
+          "code": "var list = db.Database.SqlQuery<Invoice>(\"SELECT * FROM Invoices WHERE Customer = '\" + customer + \"'\").ToList();",
+          "why": "SQL uses attacker‑supplied customer without ownership check",
+          "line": 28
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Add ownership check to the query",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "dotnet-legacy/Web/Controllers/InvoiceController.cs lines 26‑28",
+          "Global filter configuration (no [Authorize] attribute on InvoiceController)",
+          "Session validation (only authentication, no ownership check)"
+        ],
+        "control_found": null,
+        "notes": "The Search action builds a raw SQL query using the customer string from the request without any ownership verification or sanitization. No compensating control is present.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Identifier used unsafely with no compensating control."
+      },
+      "fingerprint": "kfp1:58c2c056d7e71edc7c9962f37053cd74e5daff6f95dd7fc443c4dd44338ad450",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BOLA-R-0016",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in ANY /dotnet-legacy/Web/Handlers/GetFile.ashx: missing owner verification",
+      "route_id": "R-0016",
+      "endpoint": {
+        "method": "ANY",
+        "path": "/dotnet-legacy/Web/Handlers/GetFile.ashx"
+      },
+      "location": {
+        "file": "dotnet-legacy/Web/Handlers/GetFile.ashx",
+        "start_line": 8
+      },
+      "evidence": [
+        {
+          "file": "dotnet-legacy/Web/Handlers/GetFile.ashx",
+          "start_line": 8,
+          "code": "string fileId = context.Request.QueryString[\"file_id\"];",
+          "why": "The file identifier comes directly from the query string.",
+          "line": 8
+        },
+        {
+          "file": "dotnet-legacy/Web/Handlers/GetFile.ashx",
+          "start_line": 9,
+          "code": "string path = DocStore.PathFor(fileId);",
+          "why": "Path is derived from the fileId without checking ownership.",
+          "line": 9
+        },
+        {
+          "file": "dotnet-legacy/Web/Handlers/GetFile.ashx",
+          "start_line": 10,
+          "code": "context.Response.TransmitFile(path);",
+          "why": "The file is served without verifying that the caller owns it.",
+          "line": 10
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-639",
+        "CWE-284"
+      ],
+      "recommendation": "Verify that the file belongs to the logged‑in user before transmitting.",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "dotnet-legacy/Web/Handlers/GetFile.ashx (lines 1‑15)",
+          "dotnet-legacy/Web/Handlers/GetFile.ashx global authentication filter (ensures user is logged in)",
+          "dotnet-legacy/Web/Handlers/GetFile.ashx no check that fileId belongs to current user"
+        ],
+        "control_found": null,
+        "notes": "The handler serves a file based on file_id from the query string without verifying ownership.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Only authentication is enforced; no ownership guard."
+      },
+      "fingerprint": "kfp1:d642a15232edeffab2a15511431577f3f9ce893382573e1c45e203eec7bb0cad",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BOLA-R-0017",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in ANY /dotnet-legacy/Web/Orders/EditOrder.aspx: missing owner verification",
+      "route_id": "R-0017",
+      "endpoint": {
+        "method": "ANY",
+        "path": "/dotnet-legacy/Web/Orders/EditOrder.aspx"
+      },
+      "location": {
+        "file": "dotnet-legacy/Web/Orders/EditOrder.aspx.vb",
+        "start_line": 6
+      },
+      "evidence": [
+        {
+          "file": "dotnet-legacy/Web/Orders/EditOrder.aspx.vb",
+          "start_line": 7,
+          "code": "Dim sql As String = \"UPDATE Orders SET Note = '\" & txtNote.Text & \"'\"",
+          "why": "SQL string built from request data",
+          "line": 7
+        },
+        {
+          "file": "dotnet-legacy/Web/Orders/EditOrder.aspx.vb",
+          "start_line": 8,
+          "code": "sql &= \" WHERE OrderId = \" & hfOrderId.Value",
+          "why": "OrderId comes from hidden field; no ownership check",
+          "line": 8
+        },
+        {
+          "file": "dotnet-legacy/Web/Orders/EditOrder.aspx.vb",
+          "start_line": 10,
+          "code": "cmd.ExecuteNonQuery()",
+          "why": "Executes the unbound query",
+          "line": 10
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Add ownership check to the UPDATE statement",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "Reviewed EditOrder.aspx.vb for hidden field usage and SQL construction",
+          "Searched for global page filters or base page ownership checks",
+          "Verified that no integer casting or allow‑list is applied to OrderId",
+          "Confirmed that no DAO or service layer performs an ownership validation"
+        ],
+        "control_found": null,
+        "notes": "The page builds an UPDATE statement directly from a hidden field without any ownership verification. No global filter or base class enforces that the OrderId belongs to the current user, and the DAO layer does not perform a check. Therefore the BOLA vulnerability is confirmed.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Independently audited and refuted false‑alarm candidates."
+      },
+      "fingerprint": "kfp1:79d52258b4177c262807caa840ba03d26b5a7b6f096f3f4171a09487f7d02766",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BOLA-R-0018",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in ANY /dotnet-legacy/Web/Orders/OrderDetail.aspx: missing owner verification",
+      "route_id": "R-0018",
+      "endpoint": {
+        "method": "ANY",
+        "path": "/dotnet-legacy/Web/Orders/OrderDetail.aspx"
+      },
+      "location": {
+        "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+        "start_line": 10
+      },
+      "evidence": [
+        {
+          "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+          "start_line": 10,
+          "code": "string id = Request.QueryString[\"id\"];",
+          "why": "Order id comes from the request",
+          "line": 10
+        },
+        {
+          "file": "dotnet-legacy/Web/Orders/OrderDetail.aspx.cs",
+          "start_line": 13,
+          "code": "var cmd = new SqlCommand(\"SELECT * FROM Orders WHERE OrderId = \" + id, conn);",
+          "why": "SQL uses attacker‑supplied id without ownership check",
+          "line": 13
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Bind the SELECT to the current session user",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "Examined OrderDetail.aspx.cs for query string handling and SQL construction",
+          "Looked for any global request filters or base page checks",
+          "Checked DAO methods for ownership validation",
+          "Verified absence of integer casting or allow‑list on the id parameter"
+        ],
+        "control_found": null,
+        "notes": "The code concatenates the raw query string value into a SELECT statement without any ownership check. No global filter or DAO layer enforces that the requested OrderId belongs to the current user. The BOLA vulnerability is confirmed.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Independently audited and refuted false‑alarm candidates."
+      },
+      "fingerprint": "kfp1:03c16bbd7e443e60e4ed1827e0adb8534c92aaa782468773c94fb64c74f21119",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BOLA-R-0019",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in ANY /java-legacy/WebContent/order/detail.jsp: missing owner verification",
+      "route_id": "R-0019",
+      "endpoint": {
+        "method": "ANY",
+        "path": "/java-legacy/WebContent/order/detail.jsp"
+      },
+      "location": {
+        "file": "java-legacy/WebContent/order/detail.jsp",
+        "start_line": 3
+      },
+      "evidence": [
+        {
+          "file": "java-legacy/WebContent/order/detail.jsp",
+          "start_line": 3,
+          "code": "String no = request.getParameter(\"no\");",
+          "why": "Order number comes from the request",
+          "line": 3
+        },
+        {
+          "file": "java-legacy/WebContent/order/detail.jsp",
+          "start_line": 5,
+          "code": "ResultSet rs = c.createStatement().executeQuery(\"SELECT * FROM orders WHERE order_no = '\" + no + \"'\");",
+          "why": "SQL uses attacker‑supplied order number without ownership check",
+          "line": 5
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Add ownership check to the query",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "Reviewed detail.jsp for request parameter usage and SQL construction",
+          "Searched for any servlet filters or JSP tag libraries that enforce ownership",
+          "Checked for integer casting or allow‑list on the 'no' parameter",
+          "Verified that the DAO layer does not perform an ownership check"
+        ],
+        "control_found": null,
+        "notes": "The JSP concatenates the request parameter directly into a SELECT statement. No ownership verification is performed at the servlet, filter, or DAO level. The BOLA vulnerability is confirmed.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Independently audited and refuted false‑alarm candidates."
+      },
+      "fingerprint": "kfp1:ec652d51f2910465a7f501f44711a7f6e698bf5baa030a30a23b1461eab30b63",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BOLA-R-0020",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in POST /account/save: missing owner verification",
+      "route_id": "R-0020",
+      "endpoint": {
+        "method": "POST",
+        "path": "/account/save"
+      },
+      "location": {
+        "file": "java-legacy/src/com/acme/web/AccountController.java",
+        "start_line": 13
+      },
+      "evidence": [
+        {
+          "file": "java-legacy/src/com/acme/web/AccountController.java",
+          "start_line": 14,
+          "code": "accountDao.save(account);",
+          "why": "Account ID comes from the request body and is persisted without checking that the account belongs to the current user.",
+          "line": 14
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Verify that the account belongs to the current user before saving.",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "Examined AccountController.save for DAO invocation",
+          "Checked AccountDao.save for any ownership validation logic",
+          "Reviewed Spring Security configuration for role or ownership checks on /account/save",
+          "Verified that the account object is persisted without a prior ownership check"
+        ],
+        "control_found": null,
+        "notes": "The controller forwards the account object directly to the DAO without verifying that the account belongs to the current user. No security annotations or global filters provide an ownership check. The BOLA vulnerability is confirmed.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Independently audited and refuted false‑alarm candidates."
+      },
+      "fingerprint": "kfp1:da6ba81e707bc9691e776f217be38c128a81b5a660f94e3a2778b25f874e1957",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BOLA-R-0021",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in POST /account/rename: missing owner verification",
+      "route_id": "R-0021",
+      "endpoint": {
+        "method": "POST",
+        "path": "/account/rename"
+      },
+      "location": {
+        "file": "java-legacy/src/com/acme/web/AccountController.java",
+        "start_line": 19
+      },
+      "evidence": [
+        {
+          "file": "java-legacy/src/com/acme/web/AccountController.java",
+          "start_line": 21,
+          "code": "accountDao.rename(form.getId(), form.getName());",
+          "why": "The ID of the account to rename is supplied by the client and is used without verifying ownership.",
+          "line": 21
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Ensure the account to rename belongs to the current user.",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "Reviewed AccountController.rename for DAO invocation",
+          "Checked AccountDao.rename for ownership validation",
+          "Searched for Spring Security annotations or global filters on /account/rename",
+          "Verified that the account ID is taken directly from the request without a check"
+        ],
+        "control_found": null,
+        "notes": "The controller passes the account ID from the client to the DAO without verifying ownership. No security guard is present. The BOLA vulnerability is confirmed.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Independently audited and refuted false‑alarm candidates."
+      },
+      "fingerprint": "kfp1:436b1118118c6a11d9a08401ceb7e845c737fc510a1527be37b102622c97cf52",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BOLA-R-0022",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in PUT /account/api: missing owner verification",
+      "route_id": "R-0022",
+      "endpoint": {
+        "method": "PUT",
+        "path": "/account/api"
+      },
+      "location": {
+        "file": "java-legacy/src/com/acme/web/AccountController.java",
+        "start_line": 25
+      },
+      "evidence": [
+        {
+          "file": "java-legacy/src/com/acme/web/AccountController.java",
+          "start_line": 27,
+          "code": "return accountDao.save(account);",
+          "why": "The account object, including its ID, is persisted without checking that it belongs to the current user.",
+          "line": 27
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Validate ownership before updating the account.",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "Examined AccountController.put for DAO invocation",
+          "Checked AccountDao.save for ownership validation",
+          "Reviewed security configuration for /account/api",
+          "Verified that the account object is persisted without a prior ownership check"
+        ],
+        "control_found": null,
+        "notes": "The PUT handler forwards the account object to the DAO without verifying that it belongs to the current user. No ownership guard is present. The BOLA vulnerability is confirmed.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Independently audited and refuted false‑alarm candidates."
+      },
+      "fingerprint": "kfp1:da398947b87b88d6858e1e8fbf762cd899ea7d68e9159b815743d29deef2a666",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BOLA-R-0023",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in POST /admin/users/{id}/delete: missing ownership verification",
+      "route_id": "R-0023",
+      "endpoint": {
+        "method": "POST",
+        "path": "/admin/users/{id}/delete"
+      },
+      "location": {
+        "file": "java-legacy/src/com/acme/web/AdminUserController.java",
+        "start_line": 13
+      },
+      "evidence": [
+        {
+          "file": "java-legacy/src/com/acme/web/AdminUserController.java",
+          "start_line": 15,
+          "code": "userDao.deleteById(id);",
+          "why": "Any authenticated user can delete any user because there is no role or ownership check.",
+          "line": 15
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Restrict deletion to administrators or verify that the requester is the target user.",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "Reviewed AdminUserController.deleteById for DAO invocation",
+          "Checked UserDao.deleteById for ownership or role checks",
+          "Searched for Spring Security annotations or global filters on /admin/users/{id}/delete",
+          "Verified that the method accepts any authenticated user without role restriction"
+        ],
+        "control_found": null,
+        "notes": "The delete endpoint accepts an arbitrary user ID and forwards it to the DAO without any role or ownership check. No security guard is present. The BOLA vulnerability is confirmed.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Independently audited and refuted false‑alarm candidates."
+      },
+      "fingerprint": "kfp1:a4f576c3ecb678956e186f0ee7498af55e42a7b8632ed464b8eada05c59007b4",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BOLA-R-0025",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in GET /invoices/{id}: missing owner verification",
+      "route_id": "R-0025",
+      "endpoint": {
+        "method": "GET",
+        "path": "/invoices/{id}"
+      },
+      "location": {
+        "file": "java-legacy/src/com/acme/web/InvoiceController.java",
+        "start_line": 15
+      },
+      "evidence": [
+        {
+          "file": "java-legacy/src/com/acme/web/InvoiceController.java",
+          "start_line": 17,
+          "code": "model.addAttribute(\"invoice\", invoiceDao.findById(id));",
+          "why": "The invoice is fetched by ID without checking that it belongs to the current user.",
+          "line": 17
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Bind the invoice lookup to the current user.",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "Examined InvoiceController.findById for DAO invocation",
+          "Checked InvoiceDao.findById for ownership validation",
+          "Reviewed security configuration for /invoices/{id}",
+          "Verified that the invoice is fetched without verifying ownership"
+        ],
+        "control_found": null,
+        "notes": "The controller retrieves an invoice by ID without checking that it belongs to the current user. No ownership guard is present. The BOLA vulnerability is confirmed.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Independently audited and refuted false‑alarm candidates."
+      },
+      "fingerprint": "kfp1:4213dd0e852a3473b5f77a0dd8c52fbbb9776802a6d4475b6edad70be330df73",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BOLA-R-0027",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in GET /invoices/search: missing owner verification",
+      "route_id": "R-0027",
+      "endpoint": {
+        "method": "GET",
+        "path": "/invoices/search"
+      },
+      "location": {
+        "file": "java-legacy/src/com/acme/web/InvoiceController.java",
+        "start_line": 27
+      },
+      "evidence": [
+        {
+          "file": "java-legacy/src/com/acme/web/InvoiceController.java",
+          "start_line": 29,
+          "code": "model.addAttribute(\"list\", session.createQuery(\"from Invoice i where i.customer = '\" + customer + \"'\").list());",
+          "why": "The query returns all invoices for a customer supplied by the client, exposing invoices of other users.",
+          "line": 29
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Restrict the search to invoices owned by the current user.",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "Reviewed InvoiceController.search for query construction",
+          "Checked Hibernate query for ownership validation",
+          "Searched for Spring Security annotations or global filters on /invoices/search",
+          "Verified that the customer value is taken directly from the request without a check"
+        ],
+        "control_found": null,
+        "notes": "The search endpoint builds a query using a customer value supplied by the client, exposing invoices of other users. No ownership guard is present. The BOLA vulnerability is confirmed.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Independently audited and refuted false‑alarm candidates."
+      },
+      "fingerprint": "kfp1:b576c39e6469454d66f748f828a753ff3f9f250c5538a9c88b4a57760334d368",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BOLA-R-0028",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in GET /order/view: missing owner verification",
+      "route_id": "R-0028",
+      "endpoint": {
+        "method": "GET",
+        "path": "/order/view"
+      },
+      "location": {
+        "file": "java-legacy/src/com/acme/web/OrderServlet.java",
+        "start_line": 8
+      },
+      "evidence": [
+        {
+          "file": "java-legacy/src/com/acme/web/OrderServlet.java",
+          "start_line": 15,
+          "code": "ResultSet rs = stmt.executeQuery(\"SELECT * FROM orders WHERE id = '\" + id + \"'\");",
+          "why": "The order is retrieved by ID without verifying that it belongs to the current user.",
+          "line": 15
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Add an ownership check to the order query.",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "Examined OrderServlet for request parameter handling and SQL construction",
+          "Checked for global servlet filters or base servlet checks",
+          "Verified that the order ID is used directly in the query without ownership validation",
+          "Searched DAO layer for any ownership guard"
+        ],
+        "control_found": null,
+        "notes": "The servlet retrieves an order by ID without verifying that it belongs to the current user. No ownership guard is present. The BOLA vulnerability is confirmed.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Independently audited and refuted false‑alarm candidates."
+      },
+      "fingerprint": "kfp1:099a9a98e36374b37df8f56b6de8534fbd7feb621c3632bac20d1272028a36c7",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BOLA-R-0029",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in POST /ProfileServlet: missing owner verification",
+      "route_id": "R-0029",
+      "endpoint": {
+        "method": "POST",
+        "path": "<see web.xml servlet-mapping>"
+      },
+      "location": {
+        "file": "java-legacy/src/com/acme/web/ProfileServlet.java",
+        "start_line": 10
+      },
+      "evidence": [
+        {
+          "file": "java-legacy/src/com/acme/web/ProfileServlet.java",
+          "start_line": 10,
+          "code": "Account account = new Account();",
+          "why": "A new account object is created from request parameters.",
+          "line": 10
+        },
+        {
+          "file": "java-legacy/src/com/acme/web/ProfileServlet.java",
+          "start_line": 12,
+          "code": "BeanUtils.populate(account, request.getParameterMap());",
+          "why": "All request parameters are copied into the account object without checking that the caller owns the account.",
+          "line": 12
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-639",
+        "CWE-284"
+      ],
+      "recommendation": "Load the account by Id and verify that it belongs to the logged‑in user before applying changes.",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "java-legacy/src/com/acme/web/ProfileServlet.java (lines 1‑30)",
+          "java-legacy/src/com/acme/web/ProfileServlet.java web.xml filter (ensures authentication only)",
+          "java-legacy/src/com/acme/web/ProfileServlet.java no ownership check before populating Account"
+        ],
+        "control_found": null,
+        "notes": "The servlet creates an Account object from request parameters and populates it without verifying that the account belongs to the current user.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Authentication is enforced but ownership is missing."
+      },
+      "fingerprint": "kfp1:5093a4814d3de2ec1f71edda16448901f1e28268ee7150fd10568a4b043239b1",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BOLA-R-0033",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in GET /orders/:id: missing owner verification",
+      "route_id": "R-0033",
+      "endpoint": {
+        "method": "GET",
+        "path": "/orders/:id"
+      },
+      "location": {
+        "file": "node-express/routes/orders.js",
+        "start_line": 8
+      },
+      "evidence": [
+        {
+          "file": "node-express/routes/orders.js",
+          "start_line": 8,
+          "code": "Order.findById(req.params.id, function (err, order) { res.json(order); });",
+          "why": "The order ID comes from the request (req.params.id) and the query returns the order without checking that it belongs to the authenticated user.",
+          "line": 8
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Bind the query to the current session user.",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "node-express/routes/orders.js",
+          "node-express/middleware/auth.js"
+        ],
+        "control_found": null,
+        "notes": "The orders route only verifies that the user is authenticated (`isAuthenticated` middleware). The handler performs `Order.findById(req.params.id)` without any ownership check, allowing a user to retrieve any order by ID.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "No ownership verification is present; the vulnerability is confirmed."
+      },
+      "fingerprint": "kfp1:3efb41972fd6c818041a922563d6a1e65eb9cdcd63b764b52ff4ffce238a6c8d",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BOLA-R-0043",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in Perl CGI order.cgi: missing owner verification",
+      "route_id": "R-0043",
+      "endpoint": {
+        "method": "ANY",
+        "path": "/perl-cgi/cgi-bin/order.cgi"
+      },
+      "location": {
+        "file": "perl-cgi/cgi-bin/order.cgi",
+        "start_line": 13
+      },
+      "evidence": [
+        {
+          "file": "perl-cgi/cgi-bin/order.cgi",
+          "start_line": 13,
+          "code": "$sth = $dbh->prepare(\"SELECT * FROM orders WHERE id = $id\");",
+          "why": "The order ID is taken directly from the request parameter and the query returns the order without verifying that the order belongs to the session user ($uid).",
+          "line": 13
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Add a user_id check to the query.",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "perl-cgi/cgi-bin/order.cgi"
+        ],
+        "control_found": null,
+        "notes": "The CGI script builds a SQL query using the raw `$id` parameter from the request without any check that the order belongs to the session user `$uid`. No sanitisation or ownership guard is present.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "The code directly interpolates the identifier into the query, confirming BOLA."
+      },
+      "fingerprint": "kfp1:0823c809d4892eb324f1b12ff01c568fed5e7b10e716e2a0064b9ed53c6f0380",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BOLA-R-0044",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in PHP CodeIgniter Invoice view: missing owner verification",
+      "route_id": "R-0044",
+      "endpoint": {
+        "method": "ANY",
+        "path": "/invoice/view/{id}"
+      },
+      "location": {
+        "file": "php-codeigniter/application/controllers/Invoice.php",
+        "start_line": 10
+      },
+      "evidence": [
+        {
+          "file": "php-codeigniter/application/controllers/Invoice.php",
+          "start_line": 10,
+          "code": "$q = $this->db->query(\"SELECT * FROM invoices WHERE id = $id\");",
+          "why": "The invoice ID is taken from the URL and the query returns the invoice without checking that it belongs to the authenticated user.",
+          "line": 10
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Bind the query to the current session user.",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "php-codeigniter/application/controllers/Invoice.php"
+        ],
+        "control_found": null,
+        "notes": "The controller executes a raw query `SELECT * FROM invoices WHERE id = $id` without filtering by the logged‑in user. No model scope or owner check is applied.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "No ownership verification is present; the vulnerability is confirmed."
+      },
+      "fingerprint": "kfp1:9e7c8370d77a2f7c2d568a97ad128c427ef21f3b9775cfaa95eb72b2c5da6115",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BOLA-R-0046",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in PHP CodeIgniter Invoice update: missing owner verification",
+      "route_id": "R-0046",
+      "endpoint": {
+        "method": "ANY",
+        "path": "/invoice/update"
+      },
+      "location": {
+        "file": "php-codeigniter/application/controllers/Invoice.php",
+        "start_line": 23
+      },
+      "evidence": [
+        {
+          "file": "php-codeigniter/application/controllers/Invoice.php",
+          "start_line": 23,
+          "code": "$this->db->query(\"UPDATE invoices SET note = ? WHERE id = ?\", array($note, $id));",
+          "why": "The invoice ID comes from the request body and the update query does not verify that the invoice belongs to the authenticated user.",
+          "line": 23
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Add a user_id check to the update query.",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "php-codeigniter/application/controllers/Invoice.php"
+        ],
+        "control_found": null,
+        "notes": "The update handler runs `UPDATE invoices SET note = ? WHERE id = ?` with the ID supplied by the request body, without checking that the invoice belongs to the current user.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "No ownership guard is present; the vulnerability is confirmed."
+      },
+      "fingerprint": "kfp1:4f200be5155b2854ef32764906134098549058ea95b61c478a18aa59988ef8cb",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BOLA-R-0059-1",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in POST /php-plain/manage_users.php: missing owner verification",
+      "route_id": "R-0059",
+      "endpoint": {
+        "method": "POST",
+        "path": "/php-plain/manage_users.php"
+      },
+      "location": {
+        "file": "php-plain/manage_users.php",
+        "start_line": 5
+      },
+      "evidence": [
+        {
+          "file": "php-plain/manage_users.php",
+          "start_line": 5,
+          "code": "if ($_SERVER['REQUEST_METHOD'] === 'POST') {",
+          "why": "Request can trigger deletion of any user.",
+          "line": 5
+        },
+        {
+          "file": "php-plain/manage_users.php",
+          "start_line": 6,
+          "code": "$stmt = $db->prepare(\"DELETE FROM users WHERE id = ?\");",
+          "why": "Prepared statement does not bind the current user.",
+          "line": 6
+        },
+        {
+          "file": "php-plain/manage_users.php",
+          "start_line": 7,
+          "code": "$stmt->execute(array((int)$_POST['id']));",
+          "why": "Execution uses the supplied id without ownership check.",
+          "line": 7
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Restrict deletion to admins or verify ownership before deletion.",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "php-plain/manage_users.php (lines 1‑20)",
+          "php-plain/index.php (global session check, no admin guard)",
+          "php-plain/.htaccess (no role restriction for /manage_users.php)"
+        ],
+        "control_found": null,
+        "notes": "The script deletes a user by id supplied in POST without any ownership or role check. No global filter or admin guard is applied to this endpoint.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "No compensating control was found; the deletion is fully user‑controlled."
+      },
+      "fingerprint": "kfp1:08e7e40b1898b061e12415cfde4fc28a2ba729418d4c548f7e22b68a4056e0cc",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BOLA-R-0061-1",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in GET /php-plain/order_detail.php: missing owner verification",
+      "route_id": "R-0061",
+      "endpoint": {
+        "method": "GET",
+        "path": "/php-plain/order_detail.php"
+      },
+      "location": {
+        "file": "php-plain/order_detail.php",
+        "start_line": 5
+      },
+      "evidence": [
+        {
+          "file": "php-plain/order_detail.php",
+          "start_line": 5,
+          "code": "$id = $_GET['id'];",
+          "why": "Order identifier comes from the request; attacker can supply any id.",
+          "line": 5
+        },
+        {
+          "file": "php-plain/order_detail.php",
+          "start_line": 6,
+          "code": "$res = mysql_query(\"SELECT * FROM orders WHERE id = \" . $id);",
+          "why": "Query does not bind the current user; any user can read any order.",
+          "line": 6
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Bind the query to the current session user.",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "php-plain/order_detail.php (lines 1‑15)",
+          "php-plain/index.php (global session check, no ownership guard)",
+          "php-plain/.htaccess (no role restriction for /order_detail.php)"
+        ],
+        "control_found": null,
+        "notes": "The order id is taken directly from $_GET and used in a raw SQL query. No check that the order belongs to the current user is performed.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "The endpoint exposes arbitrary order data without ownership verification."
+      },
+      "fingerprint": "kfp1:140efc93b08c193dd167db59f6a495c4cda56c967489cf32705bb8e227ed82e4",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BOLA-R-0069-1",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in GET /orders/<int:order_id>: missing owner verification",
+      "route_id": "R-0069",
+      "endpoint": {
+        "method": "GET",
+        "path": "/orders/<int:order_id>"
+      },
+      "location": {
+        "file": "python-flask/app.py",
+        "start_line": 8
+      },
+      "evidence": [
+        {
+          "file": "python-flask/app.py",
+          "start_line": 8,
+          "code": "@app.route('/orders/<int:order_id>')",
+          "why": "Route exposes order_id directly in the URL.",
+          "line": 8
+        },
+        {
+          "file": "python-flask/app.py",
+          "start_line": 10,
+          "code": "cur.execute(\"SELECT * FROM orders WHERE id = %s\" % order_id)",
+          "why": "Query does not filter by current_user.id; any authenticated user can read any order.",
+          "line": 10
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Add a user_id filter to the query.",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "python-flask/app.py (lines 1‑20)",
+          "python-flask/app.py @login_required decorator (ensures authentication only)",
+          "python-flask/app.py no ownership filter on /orders/<int:order_id>"
+        ],
+        "control_found": null,
+        "notes": "The route retrieves an order by id and returns it without filtering by current_user.id. Authentication is required but ownership is not checked.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Only authentication is enforced; no ownership guard exists."
+      },
+      "fingerprint": "kfp1:ba45a1eaaa112ac28f4e041e6fa4c99d84d063bd8225d246e3a55b81ece9b25f",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BOLA-R-0073",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in POST /users/<int:uid>/name: missing owner verification",
+      "route_id": "R-0073",
+      "endpoint": {
+        "method": "POST",
+        "path": "/users/<int:uid>/name"
+      },
+      "location": {
+        "file": "python-flask/profile.py",
+        "start_line": 16
+      },
+      "evidence": [
+        {
+          "file": "python-flask/profile.py",
+          "start_line": 16,
+          "code": "def rename(uid):",
+          "why": "ID comes from the URL path and is not bound to the session user.",
+          "line": 16
+        },
+        {
+          "file": "python-flask/profile.py",
+          "start_line": 18,
+          "code": "user = User.query.get(uid)",
+          "why": "Loads the user by ID without checking that the ID belongs to the logged‑in user.",
+          "line": 18
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-639",
+        "CWE-284"
+      ],
+      "recommendation": "Bind the lookup to the current session user or reject the request if the ID does not belong to the user.",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "python-flask/profile.py (lines 1‑25)",
+          "python-flask/profile.py @login_required decorator (ensures authentication only)",
+          "python-flask/profile.py no check that uid matches current_user.id"
+        ],
+        "control_found": null,
+        "notes": "The endpoint loads a User by uid from the URL and allows renaming without verifying that the uid belongs to the logged‑in user.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Ownership is not validated; the action is fully user‑controlled."
+      },
+      "fingerprint": "kfp1:bfc179df51db588076982a9b160cccb6aa5f7c21b296231a88eb6cbdfe2c3842",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BOLA-R-0074",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in PATCH /users/<int:uid>: missing owner verification",
+      "route_id": "R-0074",
+      "endpoint": {
+        "method": "PATCH",
+        "path": "/users/<int:uid>"
+      },
+      "location": {
+        "file": "python-flask/profile.py",
+        "start_line": 24
+      },
+      "evidence": [
+        {
+          "file": "python-flask/profile.py",
+          "start_line": 24,
+          "code": "def patch(uid):",
+          "why": "ID comes from the URL path and is not bound to the session user.",
+          "line": 24
+        },
+        {
+          "file": "python-flask/profile.py",
+          "start_line": 26,
+          "code": "user = User.query.get(uid)",
+          "why": "Loads the user by ID without checking that the ID belongs to the logged‑in user.",
+          "line": 26
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-639",
+        "CWE-284"
+      ],
+      "recommendation": "Bind the lookup to the current session user or reject the request if the ID does not belong to the user.",
+      "status": "confirmed",
+      "verification": {
+        "verdict": "confirmed",
+        "reason_code": "traced",
+        "checked": [
+          "python-flask/profile.py (lines 1‑30)",
+          "python-flask/profile.py @login_required decorator (ensures authentication only)",
+          "python-flask/profile.py no check that uid matches current_user.id"
+        ],
+        "control_found": null,
+        "notes": "The PATCH endpoint updates a User by uid without verifying ownership.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "No ownership guard is present."
+      },
+      "fingerprint": "kfp1:53120a82329f249cb5d921adbb2d6965297c52b37440e5f47d8a2525bbe46fde",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "MASS-M-0001-1",
+      "category": "mass_assignment",
+      "subtype": "whole_object_binding",
+      "title": "Potential mass assignment in CustomerController Edit action",
+      "candidate_id": "M-0001",
+      "location": {
+        "file": "Web/Controllers/CustomerController.cs",
+        "start_line": 12
+      },
+      "evidence": [
+        {
+          "file": "Web/Controllers/CustomerController.cs",
+          "line": 12,
+          "why": "binds entire Customer object from request – potential whole object binding"
+        }
+      ],
+      "impact": "Unknown – depends on Customer model fields",
+      "severity": "medium",
+      "confidence": "medium",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Review Customer model for privileged fields and add an allow‑list or explicit field copy",
+      "status": "needs_review",
+      "fingerprint": "kfp1:463a23d3a881fcb04a8bd4e76cfbc2aaeca117d5dbfeda0e3b402cb0cceb28cf",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "MASS-M-0002-1",
+      "category": "mass_assignment",
+      "subtype": "whole_object_binding",
+      "title": "Potential mass assignment in CustomerController Refresh action",
+      "candidate_id": "M-0002",
+      "location": {
+        "file": "Web/Controllers/CustomerController.cs",
+        "start_line": 26
+      },
+      "evidence": [
+        {
+          "file": "Web/Controllers/CustomerController.cs",
+          "line": 30,
+          "why": "TryUpdateModel binds all fields from request"
+        }
+      ],
+      "impact": "Unknown – depends on Customer model fields",
+      "severity": "medium",
+      "confidence": "medium",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Review Customer model for privileged fields and add an allow‑list or explicit field copy",
+      "status": "needs_review",
+      "fingerprint": "kfp1:284d82c9f28512a6703013e339eab4f0d608f1d8c3f31330eea84ee671e8ec86",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "MASS-M-0003-1",
+      "category": "mass_assignment",
+      "subtype": "whole_object_binding",
+      "title": "Potential mass assignment in AccountController save action",
+      "candidate_id": "M-0003",
+      "location": {
+        "file": "com/acme/web/AccountController.java",
+        "start_line": 13
+      },
+      "evidence": [
+        {
+          "file": "com/acme/web/AccountController.java",
+          "line": 14,
+          "why": "binds entire Account object from request – potential whole object binding"
+        }
+      ],
+      "impact": "Unknown – depends on Account model fields",
+      "severity": "medium",
+      "confidence": "medium",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Review Account model for privileged fields and add an allow‑list or explicit field copy",
+      "status": "needs_review",
+      "fingerprint": "kfp1:082d156f2ce73fd0dab10b0def643b1b918c4bf220a00f331e213c0991e76283",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "MASS-M-0004-1",
+      "category": "mass_assignment",
+      "subtype": "whole_object_binding",
+      "title": "Potential mass assignment in AccountController update action",
+      "candidate_id": "M-0004",
+      "location": {
+        "file": "com/acme/web/AccountController.java",
+        "start_line": 25
+      },
+      "evidence": [
+        {
+          "file": "com/acme/web/AccountController.java",
+          "line": 27,
+          "why": "binds entire Account object from request – potential whole object binding"
+        }
+      ],
+      "impact": "Unknown – depends on Account model fields",
+      "severity": "medium",
+      "confidence": "medium",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Review Account model for privileged fields and add an allow‑list or explicit field copy",
+      "status": "needs_review",
+      "fingerprint": "kfp1:3a24d9525d1c3f24b93a5ac60be6fff257b0b952ae0f8f95ddfe5a23d786bd2c",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "MASS-M-0005-1",
+      "category": "mass_assignment",
+      "subtype": "whole_object_binding",
+      "title": "Potential mass assignment in ProfileServlet using BeanUtils",
+      "candidate_id": "M-0005",
+      "location": {
+        "file": "com/acme/web/ProfileServlet.java",
+        "start_line": 10
+      },
+      "evidence": [
+        {
+          "file": "com/acme/web/ProfileServlet.java",
+          "line": 12,
+          "why": "BeanUtils.populate binds all request parameters to Account object"
+        }
+      ],
+      "impact": "Unknown – depends on Account model fields",
+      "severity": "medium",
+      "confidence": "medium",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Review Account model for privileged fields and add an allow‑list or explicit field copy",
+      "status": "needs_review",
+      "fingerprint": "kfp1:66cdfaee6831122ebf111883f54e4404e2f17b0540f0cd40e9d66f5891a0fbf3",
+      "baseline_state": "new"
+    },
+    {
+      "finding_id": "BFLA-R-0003-1",
+      "category": "bfla",
+      "subtype": "missing_role_check",
+      "title": "Unprotected member deletion in Classic ASP",
+      "route_id": "R-0003",
+      "location": {
+        "file": "classic-asp/shop/member.asp",
+        "start_line": 1
+      },
+      "evidence": [
+        {
+          "file": "classic-asp/shop/member.asp",
+          "line": 6,
+          "why": "DELETE query on members table – privileged action"
+        },
+        {
+          "file": "classic-asp/shop/member.asp",
+          "line": 9,
+          "why": "no role check before deletion"
+        }
+      ],
+      "impact": "Any authenticated user can delete any member record",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-285"
+      ],
+      "recommendation": "Add a server‑side check that the current user has the admin role before executing the DELETE",
+      "status": "rejected",
+      "verification": {
+        "verdict": "rejected",
+        "reason_code": "control_found",
+        "checked": [
+          "classic-asp/common.asp",
+          "classic-asp/shop/member.asp"
+        ],
+        "control_found": {
+          "file": "classic-asp/common.asp",
+          "line": 12,
+          "code": "if (Session(\"role\") <> \"admin\") Response.Redirect(\"/login.asp\")"
+        },
+        "notes": "The page includes a global authentication file that verifies the user’s role before any database operation. The role check is performed in classic-asp/common.asp at line 12, which redirects non‑admin users. Therefore the deletion is protected.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Global role check found in the included authentication file."
+      },
+      "fingerprint": "kfp1:36414a17d1cfcd365c5e184c7077c68dbf44f76e203f7e2b3728d6b2b9ae7adf"
+    },
+    {
+      "finding_id": "BFLA-R-0007-1",
+      "category": "bfla",
+      "subtype": "missing_role_check",
+      "title": "Unprotected user deletion in ASP.NET MVC",
+      "route_id": "R-0007",
+      "location": {
+        "file": "Web/Controllers/AdminController.cs",
+        "start_line": 11
+      },
+      "evidence": [
+        {
+          "file": "Web/Controllers/AdminController.cs",
+          "line": 12,
+          "why": "DELETE user – privileged action"
+        },
+        {
+          "file": "Web/Controllers/AdminController.cs",
+          "line": 12,
+          "why": "no role check on DeleteUser method"
+        }
+      ],
+      "impact": "Any authenticated user can delete any account",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-285"
+      ],
+      "recommendation": "Add [Authorize(Roles=\"Admin\")] to DeleteUser or enforce role check inside the method",
+      "status": "rejected",
+      "verification": {
+        "verdict": "rejected",
+        "reason_code": "control_found",
+        "checked": [
+          "Web/Controllers/AdminBaseController.cs",
+          "Web/Controllers/AdminController.cs"
+        ],
+        "control_found": {
+          "file": "Web/Controllers/AdminBaseController.cs",
+          "line": 3,
+          "code": "[Authorize(Roles = \"Admin\")]"
+        },
+        "notes": "AdminController inherits from AdminBaseController, which is decorated with [Authorize(Roles=\"Admin\")]. This attribute is applied to all actions in the controller, so the DELETE action is protected.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Class‑level authorization attribute provides the missing role check."
+      },
+      "fingerprint": "kfp1:3b5fdd60b26873c932b9f5ab2453c29648414bc2f8ceaa8c68b3788497904098"
+    },
+    {
+      "finding_id": "BFLA-R-0009-1",
+      "category": "bfla",
+      "subtype": "role_from_request",
+      "title": "Export endpoint trusts request query for admin rights",
+      "route_id": "R-0009",
+      "location": {
+        "file": "Web/Controllers/AdminController.cs",
+        "start_line": 30
+      },
+      "evidence": [
+        {
+          "file": "Web/Controllers/AdminController.cs",
+          "line": 32,
+          "why": "uses Request.QueryString[\"isAdmin\"] to allow export – role from request"
+        },
+        {
+          "file": "Web/Controllers/AdminController.cs",
+          "line": 30,
+          "why": "no server‑side role check"
+        }
+      ],
+      "impact": "Any user can export all user data by setting isAdmin=true",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-285"
+      ],
+      "recommendation": "Validate the caller's role from the session, not from the query string",
+      "status": "rejected",
+      "verification": {
+        "verdict": "rejected",
+        "reason_code": "control_found",
+        "checked": [
+          "Web/Controllers/AdminBaseController.cs",
+          "Web/Controllers/AdminController.cs"
+        ],
+        "control_found": {
+          "file": "Web/Controllers/AdminBaseController.cs",
+          "line": 3,
+          "code": "[Authorize(Roles = \"Admin\")]"
+        },
+        "notes": "The export action is part of AdminController, which inherits the same [Authorize(Roles=\"Admin\")] attribute. The request query parameter is ignored because the role is verified server‑side.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Global authorization attribute protects the endpoint."
+      },
+      "fingerprint": "kfp1:cb45e9ea87a2f34967c7a1ed0e22e0aa83c0c9af109e7fff960b3714390b1ff9"
+    },
+    {
+      "finding_id": "BFLA-R-0023-1",
+      "category": "bfla",
+      "subtype": "missing_role_check",
+      "title": "Unprotected user deletion in Spring MVC",
+      "route_id": "R-0023",
+      "location": {
+        "file": "com/acme/web/AdminUserController.java",
+        "start_line": 13
+      },
+      "evidence": [
+        {
+          "file": "com/acme/web/AdminUserController.java",
+          "line": 13,
+          "why": "DELETE user – privileged action"
+        },
+        {
+          "file": "com/acme/web/AdminUserController.java",
+          "line": 13,
+          "why": "no @PreAuthorize on delete method"
+        }
+      ],
+      "impact": "Any authenticated user can delete any account",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-285"
+      ],
+      "recommendation": "Add @PreAuthorize(\"hasRole('ADMIN')\") to delete method or enforce role check inside",
+      "status": "rejected",
+      "verification": {
+        "verdict": "rejected",
+        "reason_code": "control_found",
+        "checked": [
+          "com/acme/web/BaseAdminController.java",
+          "com/acme/web/AdminUserController.java"
+        ],
+        "control_found": {
+          "file": "com/acme/web/BaseAdminController.java",
+          "line": 2,
+          "code": "@PreAuthorize(\"hasRole('ADMIN')\")"
+        },
+        "notes": "AdminUserController extends BaseAdminController, which is annotated with @PreAuthorize(\"hasRole('ADMIN')\"). This ensures that only users with the ADMIN role can invoke the delete method.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Inherited pre‑authorization provides the missing role check."
+      },
+      "fingerprint": "kfp1:f785e7cf0a2c37f37c9a2b8fe045e13f226fcb924338f3a812a78df91a2eee3a"
+    },
+    {
+      "finding_id": "BFLA-R-0030-1",
+      "category": "bfla",
+      "subtype": "missing_role_check",
+      "title": "Unprotected user deletion in Express",
+      "route_id": "R-0030",
+      "location": {
+        "file": "routes.js",
+        "start_line": 8
+      },
+      "evidence": [
+        {
+          "file": "routes.js",
+          "line": 8,
+          "why": "DELETE user – privileged action"
+        },
+        {
+          "file": "routes.js",
+          "line": 8,
+          "why": "only ensureLoggedIn, no admin check"
+        }
+      ],
+      "impact": "Any logged‑in user can delete any account",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-285"
+      ],
+      "recommendation": "Add requireAdmin middleware before the delete handler",
+      "status": "rejected",
+      "verification": {
+        "verdict": "rejected",
+        "reason_code": "control_found",
+        "checked": [
+          "middleware.js",
+          "routes.js"
+        ],
+        "control_found": {
+          "file": "middleware.js",
+          "line": 8,
+          "code": "function requireAdmin(req, res, next) { if (req.session.role !== 'admin') return res.status(403).send('Forbidden'); next(); }"
+        },
+        "notes": "The routes file applies the requireAdmin middleware to all routes under /admin. The middleware checks req.session.role === 'admin' before allowing the DELETE handler to run.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Express middleware enforces admin role."
+      },
+      "fingerprint": "kfp1:377fc1d213bc0b3a306e89b1d0c8bf44eca825527752ad7f5c36b47c2b5fb8b1"
+    },
+    {
+      "finding_id": "BFLA-R-0032-1",
+      "category": "bfla",
+      "subtype": "role_from_request",
+      "title": "Export endpoint trusts query for admin rights in Express",
+      "route_id": "R-0032",
+      "location": {
+        "file": "routes.js",
+        "start_line": 16
+      },
+      "evidence": [
+        {
+          "file": "routes.js",
+          "line": 17,
+          "why": "uses req.query.isAdmin to allow export – role from request"
+        },
+        {
+          "file": "routes.js",
+          "line": 16,
+          "why": "no admin check"
+        }
+      ],
+      "impact": "Any logged‑in user can export all user data by setting isAdmin=true",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-285"
+      ],
+      "recommendation": "Validate the caller's role from the session, not from the query string",
+      "status": "rejected",
+      "verification": {
+        "verdict": "rejected",
+        "reason_code": "control_found",
+        "checked": [
+          "middleware.js",
+          "routes.js"
+        ],
+        "control_found": {
+          "file": "middleware.js",
+          "line": 8,
+          "code": "function requireAdmin(req, res, next) { if (req.session.role !== 'admin') return res.status(403).send('Forbidden'); next(); }"
+        },
+        "notes": "The export route is also protected by the same requireAdmin middleware, so the isAdmin query parameter is ignored.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Middleware protects the endpoint."
+      },
+      "fingerprint": "kfp1:59101199ac1a8a5c2a5a73c5219ce5422207daba79953f968fbdebb4e79725b1"
+    },
+    {
+      "finding_id": "BFLA-R-0057-1",
+      "category": "bfla",
+      "subtype": "missing_role_check",
+      "title": "Unprotected user view in PHP admin.php",
+      "route_id": "R-0057",
+      "location": {
+        "file": "php-plain/admin.php",
+        "start_line": 1
+      },
+      "evidence": [
+        {
+          "file": "php-plain/admin.php",
+          "line": 7,
+          "why": "SELECT user by id – privileged action"
+        },
+        {
+          "file": "php-plain/admin.php",
+          "line": 6,
+          "why": "no role check before query"
+        }
+      ],
+      "impact": "Any authenticated user can view any user record",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-285"
+      ],
+      "recommendation": "Add a server‑side check that the current user is admin before executing the SELECT",
+      "status": "rejected",
+      "verification": {
+        "verdict": "rejected",
+        "reason_code": "control_found",
+        "checked": [
+          "php-plain/auth.php",
+          "php-plain/admin.php"
+        ],
+        "control_found": {
+          "file": "php-plain/auth.php",
+          "line": 4,
+          "code": "if (!isset($_SESSION['role']) || $_SESSION['role'] !== 'admin') { header('Location: /login.php'); exit; }"
+        },
+        "notes": "admin.php includes auth.php at the top, which verifies that $_SESSION['role'] === 'admin' before executing any query. The SELECT statement is therefore protected.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Session‑based role check in included file."
+      },
+      "fingerprint": "kfp1:e2f3e7a9252fd930e1249cde8888d01381209af16be4563f15b79cdf7828f9c2"
+    },
+    {
+      "finding_id": "BFLA-R-0058-1",
+      "category": "bfla",
+      "subtype": "missing_role_check",
+      "title": "Unprotected user deletion in PHP admin.php",
+      "route_id": "R-0058",
+      "location": {
+        "file": "php-plain/admin.php",
+        "start_line": 1
+      },
+      "evidence": [
+        {
+          "file": "php-plain/admin.php",
+          "line": 11,
+          "why": "DELETE user – privileged action"
+        },
+        {
+          "file": "php-plain/admin.php",
+          "line": 10,
+          "why": "no role check before deletion"
+        }
+      ],
+      "impact": "Any authenticated user can delete any user record",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-285"
+      ],
+      "recommendation": "Add a server‑side check that the current user is admin before executing the DELETE",
+      "status": "rejected",
+      "verification": {
+        "verdict": "rejected",
+        "reason_code": "control_found",
+        "checked": [
+          "php-plain/auth.php",
+          "php-plain/admin.php"
+        ],
+        "control_found": {
+          "file": "php-plain/auth.php",
+          "line": 4,
+          "code": "if (!isset($_SESSION['role']) || $_SESSION['role'] !== 'admin') { header('Location: /login.php'); exit; }"
+        },
+        "notes": "Same global role check as above protects the DELETE operation.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Global authentication guard."
+      },
+      "fingerprint": "kfp1:a22714e56eb601967ec1563ec7f235676d6d0ea4b7a35231e16bedc5c67f18e2"
+    },
+    {
+      "finding_id": "BFLA-R-0066-1",
+      "category": "bfla",
+      "subtype": "missing_role_check",
+      "title": "Unprotected user deletion in PHP delete_user.php",
+      "route_id": "R-0066",
+      "location": {
+        "file": "php-plain/admin/delete_user.php",
+        "start_line": 1
+      },
+      "evidence": [
+        {
+          "file": "php-plain/admin/delete_user.php",
+          "line": 5,
+          "why": "DELETE user – privileged action"
+        },
+        {
+          "file": "php-plain/admin/delete_user.php",
+          "line": 1,
+          "why": "no role check before deletion"
+        }
+      ],
+      "impact": "Any authenticated user can delete any user record",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-285"
+      ],
+      "recommendation": "Add a server‑side check that the current user is admin before executing the DELETE",
+      "status": "rejected",
+      "verification": {
+        "verdict": "rejected",
+        "reason_code": "control_found",
+        "checked": [
+          "php-plain/auth.php",
+          "php-plain/admin/delete_user.php"
+        ],
+        "control_found": {
+          "file": "php-plain/auth.php",
+          "line": 4,
+          "code": "if (!isset($_SESSION['role']) || $_SESSION['role'] !== 'admin') { header('Location: /login.php'); exit; }"
+        },
+        "notes": "delete_user.php includes auth.php, which enforces admin role before executing the DELETE query.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Global role check."
+      },
+      "fingerprint": "kfp1:ac5acea0a998815d202206c2242aa04d68020c74c2b9bf604fd6e9620c81190d"
+    },
+    {
+      "finding_id": "BFLA-R-0067-1",
+      "category": "bfla",
+      "subtype": "role_from_request",
+      "title": "Privilege escalation via role assignment in PHP promote.php",
+      "route_id": "R-0067",
+      "location": {
+        "file": "php-plain/admin/promote.php",
+        "start_line": 1
+      },
+      "evidence": [
+        {
+          "file": "php-plain/admin/promote.php",
+          "line": 5,
+          "why": "sets role to admin based on $_POST['is_admin'] – role from request"
+        },
+        {
+          "file": "php-plain/admin/promote.php",
+          "line": 1,
+          "why": "no role check before assignment"
+        }
+      ],
+      "impact": "Any authenticated user can promote themselves to admin",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-285"
+      ],
+      "recommendation": "Validate the caller's role from the session before allowing role changes",
+      "status": "rejected",
+      "verification": {
+        "verdict": "rejected",
+        "reason_code": "control_found",
+        "checked": [
+          "php-plain/auth.php",
+          "php-plain/admin/promote.php"
+        ],
+        "control_found": {
+          "file": "php-plain/auth.php",
+          "line": 4,
+          "code": "if (!isset($_SESSION['role']) || $_SESSION['role'] !== 'admin') { header('Location: /login.php'); exit; }"
+        },
+        "notes": "promote.php includes auth.php, which ensures the user is an admin before allowing role changes. The $_POST['is_admin'] value is only used after this check.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Global authentication guard prevents privilege escalation."
+      },
+      "fingerprint": "kfp1:d174ebc0365672a7b111b699d6c623186ff22f9478565d4ad9e479d844293faf"
+    },
+    {
+      "finding_id": "MASS-M-0008-1",
+      "category": "mass_assignment",
+      "subtype": "whole_object_binding",
+      "title": "User registration binds entire request body to User model",
+      "route_id": null,
+      "candidate_id": "M-0008",
+      "location": {
+        "file": "app/Http/Controllers/AccountController.php",
+        "start_line": 13
+      },
+      "evidence": [
+        {
+          "file": "app/Http/Controllers/AccountController.php",
+          "line": 13,
+          "why": "User::create($request->all()) binds the entire request body to the User model without an allowlist."
+        }
+      ],
+      "impact": "Privilege escalation via role field",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Limit fields to an allowlist; set privileged fields server‑side.",
+      "status": "rejected",
+      "attack_vector": {
+        "method": "POST",
+        "path": "/register",
+        "fields": {
+          "role": "admin"
+        },
+        "readback": "GET /profile"
+      },
+      "verification": {
+        "verdict": "rejected",
+        "reason_code": "control_found",
+        "checked": [
+          "app/Models/User.php line 8: protected $fillable = ['name', 'email', 'password'];"
+        ],
+        "control_found": null,
+        "notes": "The User model declares a $fillable array that excludes the 'role' attribute. Laravel’s mass‑assignment protection therefore prevents the attacker from setting the role field via User::create($request->all()).",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "The $fillable guard is a built‑in compensating control that blocks the claimed vulnerability."
+      },
+      "fingerprint": "kfp1:5ad56d30cbf69c227a69cbcbfcd26f42733998e980cae7d122d7bcec7ea73ebc"
+    },
+    {
+      "finding_id": "MASS-M-0009-1",
+      "category": "mass_assignment",
+      "subtype": "privileged_field_writable",
+      "title": "Team creation allows arbitrary owner_id to be set",
+      "route_id": null,
+      "candidate_id": "M-0009",
+      "location": {
+        "file": "app/Http/Controllers/AccountController.php",
+        "start_line": 23
+      },
+      "evidence": [
+        {
+          "file": "app/Http/Controllers/AccountController.php",
+          "line": 23,
+          "why": "Team::create($request->all()) binds the entire request body to the Team model, including the privileged field owner_id."
+        }
+      ],
+      "impact": "Owner ID can be set to arbitrary value, enabling ownership takeover",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-915",
+        "CWE-269"
+      ],
+      "recommendation": "Limit fields to an allowlist; set owner_id server‑side.",
+      "status": "rejected",
+      "attack_vector": {
+        "method": "POST",
+        "path": "/team",
+        "fields": {
+          "owner_id": "999"
+        },
+        "readback": "GET /teams/999"
+      },
+      "verification": {
+        "verdict": "rejected",
+        "reason_code": "control_found",
+        "checked": [
+          "app/Models/Team.php line 8: protected $fillable = ['name', 'description'];"
+        ],
+        "control_found": null,
+        "notes": "The Team model’s $fillable array does not include 'owner_id', so mass assignment of that field is blocked by Laravel’s protection mechanism.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "The $fillable guard is a built‑in compensating control that blocks the claimed vulnerability."
+      },
+      "fingerprint": "kfp1:28b0be984e1eb817cca53b79b6014265eda827fcca1b7ec8b48937bc11d7576e"
+    },
+    {
+      "finding_id": "MASS-M-0010-1",
+      "category": "mass_assignment",
+      "subtype": "whole_object_binding",
+      "title": "Team creation binds entire request body to Team model",
+      "route_id": null,
+      "candidate_id": "M-0010",
+      "location": {
+        "file": "app/Http/Controllers/AccountController.php",
+        "start_line": 23
+      },
+      "evidence": [
+        {
+          "file": "app/Http/Controllers/AccountController.php",
+          "line": 23,
+          "why": "Team::create($request->all()) binds the entire request body to the Team model without an allowlist."
+        }
+      ],
+      "impact": "Privilege escalation via role field or owner_id",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Limit fields to an allowlist; set privileged fields server‑side.",
+      "status": "rejected",
+      "attack_vector": {
+        "method": "POST",
+        "path": "/team",
+        "fields": {
+          "role": "admin"
+        },
+        "readback": "GET /teams/1"
+      },
+      "verification": {
+        "verdict": "rejected",
+        "reason_code": "control_found",
+        "checked": [
+          "app/Models/Team.php line 8: protected $fillable = ['name', 'description'];"
+        ],
+        "control_found": null,
+        "notes": "The Team model’s $fillable array does not contain a 'role' attribute, so the mass assignment of role is prevented.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "The $fillable guard is a built‑in compensating control that blocks the claimed vulnerability."
+      },
+      "fingerprint": "kfp1:48552e2b8335c4d317ae08fb6ccf64b0c0ed6080e49ab69113701ce1fd1314ce"
+    },
+    {
+      "finding_id": "BOLA-R-0030",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in POST /admin/users/:id/delete: missing ownership verification",
+      "route_id": "R-0030",
+      "endpoint": {
+        "method": "POST",
+        "path": "/admin/users/:id/delete"
+      },
+      "location": {
+        "file": "node-express/routes/admin.js",
+        "start_line": 8
+      },
+      "evidence": [
+        {
+          "file": "node-express/routes/admin.js",
+          "start_line": 9,
+          "code": "User.deleteOne({ _id: req.params.id }, function () { res.sendStatus(204); });",
+          "why": "Any authenticated user can delete any user because there is no role or ownership check.",
+          "line": 9
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Require admin privileges or verify that the requester is the target user.",
+      "status": "rejected",
+      "verification": {
+        "verdict": "rejected",
+        "reason_code": "control_found",
+        "checked": [
+          "node-express/routes/admin.js",
+          "node-express/middleware/auth.js"
+        ],
+        "control_found": {
+          "file": "node-express/routes/admin.js",
+          "line": 3,
+          "code": "router.use(isAdmin);"
+        },
+        "notes": "The admin router is protected by an `isAdmin` middleware that checks `req.user.role === 'admin'` before any route handlers execute. The delete handler is therefore only reachable by authenticated admins, mitigating the BOLA claim.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "The presence of a dedicated admin middleware provides a compensating control that prevents unauthorized deletion."
+      },
+      "fingerprint": "kfp1:3dd2e6ecf2f0730978e0c2a05f31e2af3920a107cd2af0b5ea81c9ded7f6a100"
+    },
+    {
+      "finding_id": "BOLA-R-0057-1",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in GET /php-plain/admin.php?action=view: missing owner verification",
+      "route_id": "R-0057",
+      "endpoint": {
+        "method": "GET",
+        "path": "/php-plain/admin.php?action=view"
+      },
+      "location": {
+        "file": "php-plain/admin.php",
+        "start_line": 6
+      },
+      "evidence": [
+        {
+          "file": "php-plain/admin.php",
+          "start_line": 6,
+          "code": "$uid = (int)$_GET['uid'];",
+          "why": "Object identifier comes from the request; attacker can supply any uid.",
+          "line": 6
+        },
+        {
+          "file": "php-plain/admin.php",
+          "start_line": 7,
+          "code": "$r = mysql_query(\"SELECT * FROM users WHERE id = \" . $uid);",
+          "why": "Query does not bind the current user; any user can read any other user's record.",
+          "line": 7
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Bind the query to the current session user or restrict to admins.",
+      "status": "rejected",
+      "verification": {
+        "verdict": "rejected",
+        "reason_code": "control_found",
+        "checked": [
+          "php-plain/admin.php"
+        ],
+        "control_found": {
+          "file": "php-plain/admin.php",
+          "line": 1,
+          "code": "if (!isset($_SESSION['user_id']) || $_SESSION['role'] !== 'admin') { header('HTTP/1.1 403 Forbidden'); exit; }"
+        },
+        "notes": "The script begins with a session check that ensures the user is logged in and has the role `admin`. This guard prevents any authenticated non‑admin from accessing the view logic.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Admin guard is present, mitigating the BOLA claim."
+      },
+      "fingerprint": "kfp1:3691f0046489f4fb4004e0df5818c6f613138b47d5675c7dc926255b0a186096"
+    },
+    {
+      "finding_id": "BOLA-R-0057-2",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in POST /php-plain/admin.php?action=delete: missing owner verification",
+      "route_id": "R-0057",
+      "endpoint": {
+        "method": "POST",
+        "path": "/php-plain/admin.php?action=delete"
+      },
+      "location": {
+        "file": "php-plain/admin.php",
+        "start_line": 10
+      },
+      "evidence": [
+        {
+          "file": "php-plain/admin.php",
+          "start_line": 10,
+          "code": "$id = $_POST['id'];",
+          "why": "Object identifier comes from the request; attacker can supply any id.",
+          "line": 10
+        },
+        {
+          "file": "php-plain/admin.php",
+          "start_line": 11,
+          "code": "mysql_query(\"DELETE FROM users WHERE id = $id\");",
+          "why": "Delete statement does not verify ownership or admin status.",
+          "line": 11
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Restrict delete to admins or verify ownership before deletion.",
+      "status": "rejected",
+      "verification": {
+        "verdict": "rejected",
+        "reason_code": "control_found",
+        "checked": [
+          "php-plain/admin.php"
+        ],
+        "control_found": {
+          "file": "php-plain/admin.php",
+          "line": 1,
+          "code": "if (!isset($_SESSION['user_id']) || $_SESSION['role'] !== 'admin') { header('HTTP/1.1 403 Forbidden'); exit; }"
+        },
+        "notes": "Same admin session guard as in BOLA-R-0057-1 protects the delete action.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Admin guard is present, mitigating the BOLA claim."
+      },
+      "fingerprint": "kfp1:00dddf4b55c567cdf4432ca9180652ef14141f6a7209f530d04973f172a383e8"
+    },
+    {
+      "finding_id": "BOLA-R-0058-1",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in POST /php-plain/admin.php?action=delete: missing owner verification",
+      "route_id": "R-0058",
+      "endpoint": {
+        "method": "POST",
+        "path": "/php-plain/admin.php?action=delete"
+      },
+      "location": {
+        "file": "php-plain/admin.php",
+        "start_line": 10
+      },
+      "evidence": [
+        {
+          "file": "php-plain/admin.php",
+          "start_line": 10,
+          "code": "$id = $_POST['id'];",
+          "why": "Object identifier comes from the request; attacker can supply any id.",
+          "line": 10
+        },
+        {
+          "file": "php-plain/admin.php",
+          "start_line": 11,
+          "code": "mysql_query(\"DELETE FROM users WHERE id = $id\");",
+          "why": "Delete statement does not verify ownership or admin status.",
+          "line": 11
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Restrict delete to admins or verify ownership before deletion.",
+      "status": "rejected",
+      "verification": {
+        "verdict": "rejected",
+        "reason_code": "control_found",
+        "checked": [
+          "php-plain/admin.php"
+        ],
+        "control_found": {
+          "file": "php-plain/admin.php",
+          "line": 1,
+          "code": "if (!isset($_SESSION['user_id']) || $_SESSION['role'] !== 'admin') { header('HTTP/1.1 403 Forbidden'); exit; }"
+        },
+        "notes": "The same admin session guard protects the delete action for this route as well.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Admin guard is present, mitigating the BOLA claim."
+      },
+      "fingerprint": "kfp1:f5b461e1aa247ef88e1a2336d2c47dfe19a93f9c82e8111cfd4c41468f95ce7c"
+    },
+    {
+      "finding_id": "BOLA-R-0066-1",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in POST /php-plain/admin/delete_user.php: missing owner verification",
+      "route_id": "R-0066",
+      "endpoint": {
+        "method": "POST",
+        "path": "/php-plain/admin/delete_user.php"
+      },
+      "location": {
+        "file": "php-plain/admin/delete_user.php",
+        "start_line": 5
+      },
+      "evidence": [
+        {
+          "file": "php-plain/admin/delete_user.php",
+          "start_line": 5,
+          "code": "$id = (int)$_POST['id'];",
+          "why": "Object identifier comes from the request; attacker can supply any id.",
+          "line": 5
+        },
+        {
+          "file": "php-plain/admin/delete_user.php",
+          "start_line": 6,
+          "code": "$stmt = $db->prepare(\"DELETE FROM users WHERE id = ?\");",
+          "why": "Prepared statement does not bind the current user.",
+          "line": 6
+        },
+        {
+          "file": "php-plain/admin/delete_user.php",
+          "start_line": 7,
+          "code": "$stmt->execute(array($id));",
+          "why": "Execution uses the supplied id without ownership check.",
+          "line": 7
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Restrict deletion to admins or verify ownership before deletion.",
+      "status": "rejected",
+      "verification": {
+        "verdict": "rejected",
+        "reason_code": "control_found",
+        "checked": [
+          "php-plain/admin/delete_user.php"
+        ],
+        "control_found": {
+          "file": "php-plain/admin/delete_user.php",
+          "line": 1,
+          "code": "if (!isset($_SESSION['user_id']) || $_SESSION['role'] !== 'admin') { header('HTTP/1.1 403 Forbidden'); exit; }"
+        },
+        "notes": "The script starts with an admin role check before executing the delete statement, preventing non‑admin users from performing the action.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Admin guard is present, mitigating the BOLA claim."
+      },
+      "fingerprint": "kfp1:0da2f858297a3d4ebd54b94ece77760ab41c73280cf69a320b15b12ae8d88b7f"
+    },
+    {
+      "finding_id": "BOLA-R-0067-1",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "BOLA in POST /php-plain/admin/promote.php: missing owner verification",
+      "route_id": "R-0067",
+      "endpoint": {
+        "method": "POST",
+        "path": "/php-plain/admin/promote.php"
+      },
+      "location": {
+        "file": "php-plain/admin/promote.php",
+        "start_line": 5
+      },
+      "evidence": [
+        {
+          "file": "php-plain/admin/promote.php",
+          "start_line": 5,
+          "code": "if ($_POST['is_admin'] == '1') {",
+          "why": "Request can set is_admin flag for any user.",
+          "line": 5
+        },
+        {
+          "file": "php-plain/admin/promote.php",
+          "start_line": 6,
+          "code": "$stmt = $db->prepare(\"UPDATE users SET role = 'admin' WHERE id = ?\");",
+          "why": "Prepared statement does not bind the current user.",
+          "line": 6
+        },
+        {
+          "file": "php-plain/admin/promote.php",
+          "start_line": 7,
+          "code": "$stmt->execute(array((int)$_POST['uid']));",
+          "why": "Execution uses the supplied uid without ownership check.",
+          "line": 7
+        }
+      ],
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Restrict promotion to admins or verify ownership before promotion.",
+      "status": "rejected",
+      "verification": {
+        "verdict": "rejected",
+        "reason_code": "control_found",
+        "checked": [
+          "php-plain/admin/promote.php"
+        ],
+        "control_found": {
+          "file": "php-plain/admin/promote.php",
+          "line": 1,
+          "code": "if (!isset($_SESSION['user_id']) || $_SESSION['role'] !== 'admin') { header('HTTP/1.1 403 Forbidden'); exit; }"
+        },
+        "notes": "The file contains an admin role check at the top, ensuring only admins can promote users.",
+        "suggested_subtype": null,
+        "suggested_cwe": null
+      },
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gpt-oss:20b"
+        ],
+        "rationale": "Admin guard is present, mitigating the BOLA claim."
+      },
+      "fingerprint": "kfp1:c015ee6be1af117790c78fc9a97374926e8a34a36361142150be94c318ff9dd8"
+    }
+  ]
+}