@hoanghainh/komagu 2.6.0 → 2.7.0

package/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 All notable changes to `@hoanghainh/komagu` (published as `komainu-guard` up to v1.7.0) are documented here. From v1.2.2 on, entries are generated by [release-please](https://github.com/googleapis/release-please) from [Conventional Commits](https://www.conventionalcommits.org/). Earlier entries are copied from the [GitHub Releases](https://github.com/hoanghainh1188/komainu/releases).
 
+## [2.7.0](https://github.com/hoanghainh1188/komagu/compare/v2.6.1...v2.7.0) (2026-11-14)
+
+
+### Features
+
+* **assess:** add Path Traversal (CWE-22) and SSRF (CWE-918) LSA support ([#395](https://github.com/hoanghainh1188/komagu/issues/395)) ([#400](https://github.com/hoanghainh1188/komagu/issues/400)) ([018cd02](https://github.com/hoanghainh1188/komagu/commit/018cd021f219acc4e214460366f60edf5ad6333e))
+* **operate:** add a zero-dependency MCP server (komagu mcp --stdio) ([#399](https://github.com/hoanghainh1188/komagu/issues/399)) ([a95a08c](https://github.com/hoanghainh1188/komagu/commit/a95a08c37061b0c7a7dbb6ebb369622ba304034e))
+* **remediate:** add BFLA & Mass Assignment auto-fix strategies ([#392](https://github.com/hoanghainh1188/komagu/issues/392)) ([#396](https://github.com/hoanghainh1188/komagu/issues/396)) ([1620d44](https://github.com/hoanghainh1188/komagu/commit/1620d441086f34c4cad09c7df81e3fbbaab6e261))
+* **remediate:** add Tier 2 AI-assisted multi-line fix with verification gate ([#394](https://github.com/hoanghainh1188/komagu/issues/394)) ([#398](https://github.com/hoanghainh1188/komagu/issues/398)) ([a569378](https://github.com/hoanghainh1188/komagu/commit/a5693780710a21c52a4c7982155ff0acd7dbc044))
+
+## [2.6.1](https://github.com/hoanghainh1188/komagu/compare/v2.6.0...v2.6.1) (2026-11-11)
+
+
+### Bug Fixes
+
+* **deps:** raise vulnerable minimum versions and gate dependency audits ([#391](https://github.com/hoanghainh1188/komagu/issues/391)) ([40173a3](https://github.com/hoanghainh1188/komagu/commit/40173a36826b9a69ecb1046159d077381494850c))
+* **security:** clear the 64 open code scanning alerts before gating ([#388](https://github.com/hoanghainh1188/komagu/issues/388)) ([49372da](https://github.com/hoanghainh1188/komagu/commit/49372da959690251db6d0810c60eb15ba3f2591f))
+
+
+### Documentation
+
+* **pilot:** pin the runbook to v2.6.0 ([#386](https://github.com/hoanghainh1188/komagu/issues/386)) ([b416ff8](https://github.com/hoanghainh1188/komagu/commit/b416ff8613410d74b71a485a1ac05297abf164c6))
+
 ## [2.6.0](https://github.com/hoanghainh1188/komagu/compare/v2.5.0...v2.6.0) (2026-11-11)
 
 

package/README.md

@@ -111,6 +111,7 @@ Komagu operates on a strict **Bring-Your-Own-LLM (BYO-LLM)** and runtime-neutral
 | `komagu devsecops run <target>` | Complete SAST, secret leak (Gitleaks), and SCA scan | `npx @hoanghainh/komagu devsecops run .` |
 | `komagu simulate --scenario <name>` | Executes Breach & Attack Simulation (Times Car, Metabase SQLi, IDC Frontier) | `npx @hoanghainh/komagu simulate --target http://localhost:5001 -o report.md` |
 | `komagu demo --up` | Launches the interactive Member Portal reference app | `npx @hoanghainh/komagu demo --up` |
+| `komagu mcp --stdio` | Serves local analysis tools (scan, audit summary, leak check, inventory, dry-run fix preview) over the Model Context Protocol. Standard library only; stdout is JSON-RPC. | `npx @hoanghainh/komagu mcp --stdio` |
 
 ---
 

package/assess/lsa/knowledge/path-ssrf-patterns.md

@@ -0,0 +1,19 @@
+# Path Traversal (CWE-22) & SSRF (CWE-918) Patterns
+
+## 1. Path Traversal (`path_traversal`, CWE-22)
+
+**What to look for:**
+- File-system read/write/download/include sinks (`open`, `fs.readFile`, `res.sendFile`, `new File`, `Files.readAllBytes`, `file_get_contents`, `File.ReadAllText`, `os.Open`) receiving a filename or subpath from request input (`req.query`, `$_GET`, `@RequestParam`, etc.).
+
+**False-positive checks (do NOT report when present):**
+- The path is canonicalized (`realpath`, `getCanonicalPath`, `Path.GetFullPath`, `filepath.Clean`) **and** verified to start with the intended base directory (`resolved.startsWith(baseDir)`).
+- Only an allow-listed fixed filename or basename without directory traversal (`..`) is accepted, or a lookup maps an opaque ID to a server-side path.
+
+## 2. Server-Side Request Forgery (`ssrf`, CWE-918)
+
+**What to look for:**
+- Outbound HTTP/network clients (`requests.get`, `urllib.request.urlopen`, `fetch`, `axios`, `HttpURLConnection`, `RestTemplate`, `curl_init`, `HttpClient`, `http.Get`) using a URL, host, or webhook target controlled by the caller.
+
+**False-positive checks (do NOT report when present):**
+- The scheme and hostname are validated against an explicit server-side allow-list before the request is sent.
+- DNS resolution is checked to reject loopback (`127.0.0.0/8`, `::1`), link-local/cloud metadata (`169.254.169.254`), and RFC1918 private ranges (`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) with redirects disabled or re-validated.

package/assess/lsa/knowledge/severity-and-cwe.md

@@ -36,8 +36,10 @@ See `_shared-rules.md` §4. Severity and confidence are independent: a
 | `sql_injection` | string_concatenation, string_interpolation, format_string, template_placeholder, dynamic_identifier, second_order, stored_procedure_dynamic_sql | CWE-89 | A03:2021 |
 | `sql_injection` | (HQL/JPQL) | CWE-564, CWE-89 | A03:2021 |
 | `nosql_injection` | operator_injection, js_injection | CWE-943 | A03:2021 |
+| `path_traversal` | arbitrary_file_read, arbitrary_file_write | CWE-22 | A01:2021 |
+| `ssrf` | unvalidated_outbound_url, internal_metadata_probe | CWE-918 | A10:2021, API7:2023 |
 
-Finding id prefixes: `BOLA-`, `INJ-`, `BFLA-`, `MASS-`.
+Finding id prefixes: `BOLA-`, `INJ-`, `BFLA-`, `MASS-`, `PATH-`, `SSRF-`.
 
 ## Fingerprint
 

package/assess/lsa/scripts/find_path_ssrf.py

@@ -0,0 +1,176 @@
+#!/usr/bin/env python3
+"""Deterministic Tier 1 pre-scanner for Path Traversal (CWE-22) and SSRF (CWE-918).
+
+Usage: find_path_ssrf.py TARGET [--config audit-config.json] [--out path-ssrf.candidates.json]
+
+Standard-library-only (Python 3.8+).
+"""
+from __future__ import annotations
+
+import argparse
+import re
+import sys
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Pattern, Tuple
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from lsa_common import KIT_VERSION, iter_source_files, load_config, write_json  # noqa: E402
+from redaction import redact  # noqa: E402
+
+_PATH_SINKS: Tuple[Tuple[str, Pattern[str]], ...] = (
+    ("fs_read_node", re.compile(r"\b(?:fs\.(?:readFile|readFileSync|createReadStream|writeFile|writeFileSync)|res\.(?:sendFile|download))\s*\(")),
+    ("path_open_py", re.compile(r"\b(?:open|send_file|send_from_directory)\s*\(")),
+    ("file_java", re.compile(r"\b(?:new\s+File|Paths\.get|Files\.(?:readAllBytes|readString|newInputStream|copy))\s*\(")),
+    ("file_php", re.compile(r"\b(?:file_get_contents|fopen|readfile|include_once|require_once|include|require)\s*(?:\(| )")),
+    ("file_dotnet", re.compile(r"\bFile\.(?:ReadAllText|ReadAllBytes|OpenRead|OpenWrite)\s*\(")),
+    ("file_go", re.compile(r"\b(?:os\.(?:Open|ReadFile|Create)|ioutil\.ReadFile)\s*\(")),
+)
+
+_SSRF_SINKS: Tuple[Tuple[str, Pattern[str]], ...] = (
+    ("http_py", re.compile(r"\b(?:requests\.(?:get|post|put|delete|head|request)|urllib\.request\.urlopen|httpx\.(?:get|post|request))\s*\(")),
+    ("http_node", re.compile(r"\b(?:fetch|axios(?:\.(?:get|post|put|request))?|https?\.(?:get|request))\s*\(")),
+    ("http_java", re.compile(r"\b(?:new\s+URL\s*\(|HttpURLConnection|RestTemplate\.(?:getFor|postFor|exchange)|WebClient\.)")),
+    ("http_php", re.compile(r"\b(?:curl_init|file_get_contents)\s*\(")),
+    ("http_dotnet", re.compile(r"\b(?:HttpClient|WebRequest\.Create)\b")),
+    ("http_go", re.compile(r"\bhttp\.(?:Get|Post|NewRequest)\s*\(")),
+)
+
+_REQUEST_INPUT_HINT = re.compile(
+    r"(?:\$_(?:GET|POST|REQUEST)|"
+    r"\breq(?:uest)?\.(?:query|params|body|args|form|GET|POST|URL)|"
+    r"\b(?:getParameter|@RequestParam|@PathVariable|r\.URL\.Query|QueryRow|Request\.QueryString)\b|"
+    r"\b(?:file_?name|file_?path|target_?url|webhook_?url|callback_?url|redirect_?url|endpoint_?url|avatar_?url)\b)",
+    re.IGNORECASE,
+)
+
+_LITERAL_ONLY_CALL = re.compile(
+    r"\(\s*(?:['\"][^'\"]+['\"]\s*(?:,|\))|`https?://[^`$]+`)"
+)
+
+_PATH_SANITIZER_HINT = re.compile(
+    r"(?:\brealpath\b|\bcanonical(?:Path)?\b|\bGetFullPath\b|\bPath\.basename\b|\bos\.path\.basename\b|\bfilepath\.Clean\b|\bstartsWith\s*\()",
+    re.IGNORECASE,
+)
+
+_SSRF_SANITIZER_HINT = re.compile(
+    r"(?:\ballowlist\b|\bwhitelist\b|\ballowed_?hosts?\b|\bis_safe_url\b|\bvalidate_url\b)",
+    re.IGNORECASE,
+)
+
+
+def _has_nearby_input(lines: List[str], idx: int, window: int = 5) -> bool:
+    """True when request-controlled input appears on the sink line or within +-window lines."""
+    start = max(0, idx - window)
+    end = min(len(lines), idx + 2)
+    snippet = "\n".join(lines[start:end])
+    return _REQUEST_INPUT_HINT.search(snippet) is not None
+
+
+def _has_nearby_guard(lines: List[str], idx: int, guard_rx: Pattern[str], window: int = 4) -> bool:
+    """True when a sanitizer/allow-list guard is visible near the sink."""
+    start = max(0, idx - window)
+    end = min(len(lines), idx + 2)
+    return guard_rx.search("\n".join(lines[start:end])) is not None
+
+
+def scan_file_path_ssrf(path: Path, rel: str) -> List[Dict[str, Any]]:
+    """Scan a single source file for Path Traversal (CWE-22) and SSRF (CWE-918) candidates."""
+    try:
+        text = path.read_text(encoding="utf-8", errors="replace")
+    except OSError:
+        return []
+
+    lines = text.splitlines()
+    candidates: List[Dict[str, Any]] = []
+
+    for idx, line in enumerate(lines):
+        stripped = line.strip()
+        if not stripped or stripped.startswith(("//", "#", "/*", "*")):
+            continue
+        if _LITERAL_ONLY_CALL.search(stripped):
+            continue
+
+        # Check SSRF first when PHP file_get_contents is used with URL hints
+        matched_ssrf = False
+        for sink_id, rx in _SSRF_SINKS:
+            if rx.search(stripped):
+                if sink_id == "http_php" and "file_get_contents" in stripped and not re.search(r"url|http", stripped, re.IGNORECASE):
+                    continue
+                if _has_nearby_input(lines, idx) and not _has_nearby_guard(lines, idx, _SSRF_SANITIZER_HINT):
+                    candidates.append(
+                        {
+                            "category": "ssrf",
+                            "cwe": "CWE-918",
+                            "sink": sink_id,
+                            "file": rel,
+                            "line": idx + 1,
+                            "snippet": redact(stripped[:240]),
+                            "priority": "high",
+                        }
+                    )
+                    matched_ssrf = True
+                break
+
+        if matched_ssrf:
+            continue
+
+        for sink_id, rx in _PATH_SINKS:
+            if rx.search(stripped):
+                if _has_nearby_input(lines, idx) and not _has_nearby_guard(lines, idx, _PATH_SANITIZER_HINT):
+                    candidates.append(
+                        {
+                            "category": "path_traversal",
+                            "cwe": "CWE-22",
+                            "sink": sink_id,
+                            "file": rel,
+                            "line": idx + 1,
+                            "snippet": redact(stripped[:240]),
+                            "priority": "high",
+                        }
+                    )
+                break
+
+    return candidates
+
+
+def find_path_ssrf(target: Path, config: Dict[str, Any], cache: Optional[Any] = None) -> Dict[str, Any]:
+    """Scan target directory for Path Traversal and SSRF candidates."""
+    all_candidates: List[Dict[str, Any]] = []
+    files_scanned = 0
+
+    for path, rel in iter_source_files(target, config):
+        files_scanned += 1
+        found = scan_file_path_ssrf(path, rel)
+        all_candidates.extend(found)
+
+    path_count = sum(1 for c in all_candidates if c["category"] == "path_traversal")
+    ssrf_count = sum(1 for c in all_candidates if c["category"] == "ssrf")
+
+    return {
+        "generated_by": f"lsa find_path_ssrf.py {KIT_VERSION}",
+        "files_scanned": files_scanned,
+        "summary": {
+            "total": len(all_candidates),
+            "path_traversal": path_count,
+            "ssrf": ssrf_count,
+        },
+        "candidates": all_candidates,
+    }
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser(description=__doc__)
+    ap.add_argument("target")
+    ap.add_argument("--config")
+    ap.add_argument("--out")
+    a = ap.parse_args()
+    res = find_path_ssrf(Path(a.target).resolve(), load_config(a.config))
+    if a.out:
+        write_json(Path(a.out), res)
+    else:
+        print(f"path_traversal={res['summary']['path_traversal']} ssrf={res['summary']['ssrf']}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/assess/lsa/scripts/findings_to_sarif.py

@@ -50,6 +50,14 @@ RULE_TEXT = {
         "Mass assignment of object properties",
         "A request body is bound to a model or entity without an allow-list, so a caller can write properties they must not control.",
     ),
+    "path_traversal": (
+        "Path traversal / arbitrary file access",
+        "A filesystem path is constructed from request-controlled input without canonicalizing and enforcing a base directory boundary.",
+    ),
+    "ssrf": (
+        "Server-Side Request Forgery (SSRF)",
+        "An outbound network request target URL is derived from request-controlled input without host allow-listing or private-IP blocking.",
+    ),
 }
 
 CWE_TAXONOMY_DEFS: Dict[str, Dict[str, str]] = {
@@ -101,6 +109,18 @@ CWE_TAXONOMY_DEFS: Dict[str, Dict[str, str]] = {
         "shortDescription": "Improper Input Validation",
         "helpUri": "https://cwe.mitre.org/data/definitions/20.html",
     },
+    "CWE-22": {
+        "id": "CWE-22",
+        "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
+        "shortDescription": "Path Traversal",
+        "helpUri": "https://cwe.mitre.org/data/definitions/22.html",
+    },
+    "CWE-918": {
+        "id": "CWE-918",
+        "name": "Server-Side Request Forgery (SSRF)",
+        "shortDescription": "Server-Side Request Forgery (SSRF)",
+        "helpUri": "https://cwe.mitre.org/data/definitions/918.html",
+    },
 }
 
 OWASP_TAGS = {
@@ -129,6 +149,15 @@ OWASP_TAGS = {
         "OWASP:A01:2021-Broken Access Control",
         "OWASP-API3:2023-BOPLA",
     ],
+    "path_traversal": [
+        "external/owasp/a01-2021-broken-access-control",
+        "OWASP:A01:2021-Broken Access Control",
+    ],
+    "ssrf": [
+        "external/owasp/a10-2021-server-side-request-forgery",
+        "OWASP:A10:2021-Server-Side Request Forgery",
+        "OWASP-API7:2023-SSRF",
+    ],
 }
 
 

package/assess/lsa/scripts/merge_findings.py

@@ -139,7 +139,7 @@ def load_validator(schema_name: str):
 
 
 BASE_CATEGORIES = ("bola", "sql_injection", "nosql_injection")
-EXTRA_CATEGORIES = ("bfla", "mass_assignment")
+EXTRA_CATEGORIES = ("bfla", "mass_assignment", "path_traversal", "ssrf")
 
 
 def count_by_category(active: List[Dict]) -> Dict[str, int]:

package/assess/lsa/scripts/run_prescan.py

@@ -25,6 +25,7 @@ from detect_stack import detect  # noqa: E402
 from changed_files import ChangedFilesError, git_changed_files, select_files  # noqa: E402
 from find_injection import find_injection  # noqa: E402
 from find_mass_assignment import find_mass_assignment  # noqa: E402
+from find_path_ssrf import find_path_ssrf  # noqa: E402
 from lsa_common import KIT_VERSION, deep_merge, load_config, write_json  # noqa: E402
 from make_batches import make_batches  # noqa: E402
 from map_routes import map_routes  # noqa: E402
@@ -91,6 +92,8 @@ def main() -> int:
     write_json(out / "injection.candidates.json", inj)
     mass = find_mass_assignment(target, scan_cfg, cache=cache)
     write_json(out / "mass-assignment.candidates.json", mass)
+    path_ssrf = find_path_ssrf(target, scan_cfg, cache=cache)
+    write_json(out / "path-ssrf.candidates.json", path_ssrf)
 
     if cache.enabled:
         cache.save()
@@ -116,6 +119,7 @@ def main() -> int:
         f"- Route candidates: {routes['summary']['total']} (with id-like params: {routes['summary']['with_id_like_params']})",
         f"- Injection candidates: {inj['summary']['total']} (high priority: {inj['summary']['high_priority']})",
         f"- Mass assignment candidates: {mass['summary']['total']} (high priority: {mass['summary']['high_priority']})",
+        f"- Path traversal / SSRF candidates: {path_ssrf['summary']['total']} (path_traversal: {path_ssrf['summary']['path_traversal']}, ssrf: {path_ssrf['summary']['ssrf']})",
         f"- BFLA route hints: {routes['summary'].get('bfla_hints', 0)}",
         f"- Batches: {len(idx['routes'])} route, {len(idx['injection'])} injection",
         f"- Knowledge files to load: {', '.join(prof['knowledge_files'])}", "",

package/assess/lsa/tests/run_tests.py

@@ -187,6 +187,10 @@ def main() -> int:
     if res_mod.returncode != 0:
         fails.append(f"test_modern_stacks.py failed:\n{res_mod.stdout}\n{res_mod.stderr}")
     print(f"  modern stacks    {'OK' if res_mod.returncode == 0 else 'FAIL'}")
+    res_ps = subprocess.run([sys.executable, str(HERE / "test_path_ssrf.py")], capture_output=True, text=True)
+    if res_ps.returncode != 0:
+        fails.append(f"test_path_ssrf.py failed:\n{res_ps.stdout}\n{res_ps.stderr}")
+    print(f"  path & ssrf      {'OK' if res_ps.returncode == 0 else 'FAIL'}")
     res_perf = subprocess.run([sys.executable, str(HERE / "test_performance.py")], capture_output=True, text=True)
     if res_perf.returncode != 0:
         fails.append(f"test_performance.py failed:\n{res_perf.stdout}\n{res_perf.stderr}")

package/assess/lsa/tests/test_path_ssrf.py

@@ -0,0 +1,94 @@
+#!/usr/bin/env python3
+"""Tests for Path Traversal (CWE-22) and SSRF (CWE-918) LSA support (Issue #395)."""
+
+from __future__ import annotations
+
+import json
+import shutil
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+KIT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(KIT / "scripts"))
+
+from find_path_ssrf import find_path_ssrf  # noqa: E402
+from findings_to_sarif import to_sarif  # noqa: E402
+from lsa_common import load_config  # noqa: E402
+
+
+class TestPathTraversalAndSSRF(unittest.TestCase):
+    """Verify Tier 1 pre-scan and SARIF export for path_traversal and ssrf."""
+
+    def setUp(self) -> None:
+        self.temp_dir = Path(tempfile.mkdtemp(prefix="komagu_path_ssrf_")).resolve()
+        self.cfg = load_config(None)
+
+    def tearDown(self) -> None:
+        shutil.rmtree(self.temp_dir, ignore_errors=True)
+
+    def test_detects_vulnerable_and_skips_sanitized(self) -> None:
+        (self.temp_dir / "files.js").write_text(
+            "const fs = require('fs');\n"
+            "app.get('/download', (req, res) => {\n"
+            "  fs.readFile('/var/data/' + req.query.file, () => {});\n"
+            "});\n"
+            "app.get('/safe-download', (req, res) => {\n"
+            "  const safe = path.basename(req.query.file);\n"
+            "  fs.readFile('/var/data/' + safe, () => {});\n"
+            "});\n",
+            encoding="utf-8",
+        )
+        (self.temp_dir / "webhook.py").write_text(
+            "import requests\n"
+            "def send_webhook(request):\n"
+            "    target_url = request.args.get('url')\n"
+            "    return requests.post(target_url, json={'ok': True})\n"
+            "def health():\n"
+            "    return requests.get('https://status.example.com/ping')\n",
+            encoding="utf-8",
+        )
+
+        res = find_path_ssrf(self.temp_dir, self.cfg)
+        self.assertEqual(res["summary"]["path_traversal"], 1)
+        self.assertEqual(res["summary"]["ssrf"], 1)
+        cats = {c["category"]: c for c in res["candidates"]}
+        self.assertEqual(cats["path_traversal"]["cwe"], "CWE-22")
+        self.assertEqual(cats["path_traversal"]["line"], 3)
+        self.assertEqual(cats["ssrf"]["cwe"], "CWE-918")
+        self.assertEqual(cats["ssrf"]["line"], 4)
+
+    def test_sarif_export_supports_path_traversal_and_ssrf(self) -> None:
+        findings = [
+            {
+                "finding_id": "PATH-01",
+                "category": "path_traversal",
+                "severity": "high",
+                "confidence": "high",
+                "status": "confirmed",
+                "title": "Arbitrary file read via ?file=",
+                "cwe": ["CWE-22"],
+                "location": {"file": "files.js", "start_line": 3},
+            },
+            {
+                "finding_id": "SSRF-01",
+                "category": "ssrf",
+                "severity": "high",
+                "confidence": "high",
+                "status": "confirmed",
+                "title": "Unvalidated webhook URL",
+                "cwe": ["CWE-918"],
+                "location": {"file": "webhook.py", "start_line": 4},
+            },
+        ]
+        sarif = to_sarif({"findings": findings}, target_dir=self.temp_dir)
+        results = sarif["runs"][0]["results"]
+        self.assertEqual(len(results), 2)
+        rule_ids = {r["ruleId"] for r in results}
+        self.assertIn("lsa/path_traversal/general", rule_ids)
+        self.assertIn("lsa/ssrf/general", rule_ids)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/contracts/schemas/finding.schema.json

@@ -19,7 +19,7 @@
   "properties": {
     "finding_id": {
       "type": "string",
-      "pattern": "^(BOLA|INJ|BFLA|MASS)-[A-Za-z0-9_.-]+$"
+      "pattern": "^(BOLA|INJ|BFLA|MASS|PATH|SSRF)-[A-Za-z0-9_.-]+$"
     },
     "category": {
       "enum": [
@@ -27,7 +27,9 @@
         "sql_injection",
         "nosql_injection",
         "bfla",
-        "mass_assignment"
+        "mass_assignment",
+        "path_traversal",
+        "ssrf"
       ]
     },
     "fingerprint": {

package/examples/member-portal/backend-dotnet/Auth/DemoAuthenticationHandler.cs

@@ -0,0 +1,75 @@
+namespace MemberPortal.Backend.Auth;
+
+using System.Security.Claims;
+using System.Text.Encodings.Web;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.Extensions.Options;
+
+/// <summary>
+/// Flexible authentication handler supporting mock tokens for personas as well as JWT claims.
+/// </summary>
+public class DemoAuthenticationHandler : AuthenticationHandler<AuthenticationSchemeOptions>
+{
+    public DemoAuthenticationHandler(
+        IOptionsMonitor<AuthenticationSchemeOptions> options,
+        ILoggerFactory logger,
+        UrlEncoder encoder)
+        : base(options, logger, encoder)
+    {
+    }
+
+    protected override Task<AuthenticateResult> HandleAuthenticateAsync()
+    {
+        if (!Request.Headers.TryGetValue("Authorization", out var authHeaderValues))
+        {
+            // Anonymous fallback
+            return Task.FromResult(AuthenticateResult.NoResult());
+        }
+
+        var header = authHeaderValues.ToString();
+        var token = header.StartsWith("Bearer ", StringComparison.OrdinalIgnoreCase)
+            ? header.Substring(7).Trim()
+            : header.Trim();
+
+        var claims = token switch
+        {
+            "token-user-a" => new[]
+            {
+                new Claim(ClaimTypes.NameIdentifier, "user-a"),
+                new Claim("sub", "user-a"),
+                new Claim("tenant_id", "tenant-alpha"),
+                new Claim("name", "Alice"),
+                new Claim(ClaimTypes.Role, "member")
+            },
+            "token-user-b" => new[]
+            {
+                new Claim(ClaimTypes.NameIdentifier, "user-b"),
+                new Claim("sub", "user-b"),
+                new Claim("tenant_id", "tenant-alpha"),
+                new Claim("name", "Bob"),
+                new Claim(ClaimTypes.Role, "member")
+            },
+            "token-user-c" => new[]
+            {
+                new Claim(ClaimTypes.NameIdentifier, "user-c"),
+                new Claim("sub", "user-c"),
+                new Claim("tenant_id", "tenant-beta"),
+                new Claim("name", "Charlie"),
+                new Claim(ClaimTypes.Role, "member")
+            },
+            _ => new[]
+            {
+                new Claim(ClaimTypes.NameIdentifier, token),
+                new Claim("sub", token),
+                new Claim("tenant_id", "tenant-alpha"),
+                new Claim(ClaimTypes.Role, "member")
+            }
+        };
+
+        var identity = new ClaimsIdentity(claims, Scheme.Name);
+        var principal = new ClaimsPrincipal(identity);
+        var ticket = new AuthenticationTicket(principal, Scheme.Name);
+
+        return Task.FromResult(AuthenticateResult.Success(ticket));
+    }
+}

package/examples/member-portal/backend-dotnet/Program.cs

@@ -1,9 +1,7 @@
-using System.Security.Claims;
-using System.Text.Encodings.Web;
+using MemberPortal.Backend.Auth;
 using MemberPortal.Backend.Data;
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.EntityFrameworkCore;
-using Microsoft.Extensions.Options;
 using Komagu.Security.Authorization;
 
 var builder = WebApplication.CreateBuilder(args);
@@ -53,72 +51,3 @@ app.UseAuthorization();
 app.MapControllers();
 
 app.Run();
-
-/// <summary>
-/// Flexible authentication handler supporting mock tokens for personas as well as JWT claims.
-/// </summary>
-public class DemoAuthenticationHandler : AuthenticationHandler<AuthenticationSchemeOptions>
-{
-    public DemoAuthenticationHandler(
-        IOptionsMonitor<AuthenticationSchemeOptions> options,
-        ILoggerFactory logger,
-        UrlEncoder encoder)
-        : base(options, logger, encoder)
-    {
-    }
-
-    protected override Task<AuthenticateResult> HandleAuthenticateAsync()
-    {
-        if (!Request.Headers.TryGetValue("Authorization", out var authHeaderValues))
-        {
-            // Anonymous fallback
-            return Task.FromResult(AuthenticateResult.NoResult());
-        }
-
-        var header = authHeaderValues.ToString();
-        var token = header.StartsWith("Bearer ", StringComparison.OrdinalIgnoreCase)
-            ? header.Substring(7).Trim()
-            : header.Trim();
-
-        var claims = token switch
-        {
-            "token-user-a" => new[]
-            {
-                new Claim(ClaimTypes.NameIdentifier, "user-a"),
-                new Claim("sub", "user-a"),
-                new Claim("tenant_id", "tenant-alpha"),
-                new Claim("name", "Alice"),
-                new Claim(ClaimTypes.Role, "member")
-            },
-            "token-user-b" => new[]
-            {
-                new Claim(ClaimTypes.NameIdentifier, "user-b"),
-                new Claim("sub", "user-b"),
-                new Claim("tenant_id", "tenant-alpha"),
-                new Claim("name", "Bob"),
-                new Claim(ClaimTypes.Role, "member")
-            },
-            "token-user-c" => new[]
-            {
-                new Claim(ClaimTypes.NameIdentifier, "user-c"),
-                new Claim("sub", "user-c"),
-                new Claim("tenant_id", "tenant-beta"),
-                new Claim("name", "Charlie"),
-                new Claim(ClaimTypes.Role, "member")
-            },
-            _ => new[]
-            {
-                new Claim(ClaimTypes.NameIdentifier, token),
-                new Claim("sub", token),
-                new Claim("tenant_id", "tenant-alpha"),
-                new Claim(ClaimTypes.Role, "member")
-            }
-        };
-
-        var identity = new ClaimsIdentity(claims, Scheme.Name);
-        var principal = new ClaimsPrincipal(identity);
-        var ticket = new AuthenticationTicket(principal, Scheme.Name);
-
-        return Task.FromResult(AuthenticateResult.Success(ticket));
-    }
-}

package/examples/member-portal/backend-spring/src/main/kotlin/io/komagu/portal/Application.kt

@@ -34,6 +34,8 @@ import java.time.Instant
 // so the identity module's JWT decoder, which requires komagu.security.oidc.*, is left out.
 @SpringBootApplication(exclude = [KomaguIdentityAutoConfiguration::class])
 class Application {
+    // Demo seed data: one literal per row, read as a table.
+    @Suppress("LongMethod")
     @Bean
     fun seedDataRunner(
         orderRepository: OrderRepository,
@@ -107,6 +109,8 @@ class Application {
     }
 }
 
+// Standard Spring Boot entry point; the copy of args happens once at startup.
+@Suppress("SpreadOperator")
 fun main(args: Array<String>) {
     runApplication<Application>(*args)
 }

package/examples/member-portal/backend-spring/src/main/kotlin/io/komagu/portal/controller/Controllers.kt

@@ -162,6 +162,9 @@ class DocumentController(
 }
 
 @RestController
+// Each endpoint keeps the planted vulnerable branch and the remediated branch side by side,
+// with early returns, so the demo shows the before and after in one place.
+@Suppress("ReturnCount")
 @RequestMapping("/api/v1/test")
 class LegacyTestController(
     private val orderRepository: OrderRepository,