@kirrosh/zond 0.26.0 → 0.27.0

package/src/core/probe/security/classify.ts

@@ -1,341 +0,0 @@
-import type { EndpointInfo } from "../../generator/types.ts";
-import { classify as classifyRecommendedAction } from "../../classifier/recommended-action.ts";
-import type {
-  SecurityClass,
-  SecurityFieldHit,
-  SecurityFinding,
-} from "./types.ts";
-
-/** ARV-56: route through the single classifier. */
-function stampAction(f: SecurityFinding): SecurityFinding {
-  const action = classifyRecommendedAction({
-    finding_class: "probe:security",
-    severity: f.severity as Parameters<typeof classifyRecommendedAction>[0]["severity"],
-  });
-  if (action) f.recommended_action = action;
-  return f;
-}
-
-export interface ClassifyResp {
-  status: number;
-  body?: unknown;
-  body_parsed?: unknown;
-  headers?: Record<string, string>;
-}
-
-export function classify(
-  hit: SecurityFieldHit,
-  payload: string,
-  resp: ClassifyResp,
-  ctx: { endpoint?: EndpointInfo } = {},
-): SecurityFinding {
-  return stampAction(classifyInner(hit, payload, resp, ctx));
-}
-
-/**
- * ARV-254: detect whether an endpoint declares delivery semantics for
- * a URL field — i.e. the server is documented to actually hit the URL
- * (webhook receiver, push subscription, callback).
- *
- * Without OOB infrastructure (interactsh / Burp Collaborator —
- * deferred to ARV-177 post-pivot), zond can't prove the server fetched
- * the URL. So SSRF "accept" lands as LOW by default. But if the spec
- * declares delivery, we know the URL gets fetched on some schedule,
- * which raises the stakes — surface as MEDIUM with an explicit
- * disclaimer that OOB verification is still required for HIGH.
- *
- * Heuristic: path or tag contains "webhook" / "callback" / "subscription"
- * (case-insensitive). When ARV-189 lands, this also reads
- * `x-zond-delivery: true` from the spec.
- */
-function endpointDeclaresDelivery(ep: EndpointInfo | undefined): boolean {
-  if (!ep) return false;
-  const haystacks: string[] = [ep.path.toLowerCase()];
-  if (Array.isArray(ep.tags)) {
-    for (const t of ep.tags) haystacks.push(String(t).toLowerCase());
-  }
-  return haystacks.some((h) => /webhook|callback|subscription/.test(h));
-}
-
-/**
- * Check whether the CRLF payload reflects into any response header
- * value. ARV-253: header reflection is the smoking gun for CRLF —
- * response splitting / header injection becomes exploitable as soon as
- * the server emits attacker-controlled bytes in headers.
- *
- * We check raw payload AND its URL-decoded form so encodings like
- * `%0d%0a` survive the comparison.
- */
-function reflectsInHeaders(payload: string, headers: Record<string, string> | undefined): string | null {
-  if (!headers || !payload) return null;
-  const decoded = safeDecodeURI(payload);
-  const variants = [payload, decoded].filter((v) => v && v.length >= 3);
-  for (const [name, value] of Object.entries(headers)) {
-    for (const v of variants) {
-      if (value.includes(v)) return name;
-    }
-  }
-  return null;
-}
-
-function isHtmlContentType(headers: Record<string, string> | undefined): boolean {
-  const ct = headers?.["content-type"] ?? headers?.["Content-Type"] ?? "";
-  return /text\/html|application\/xhtml/i.test(ct);
-}
-
-function classifyInner(
-  hit: SecurityFieldHit,
-  payload: string,
-  resp: ClassifyResp,
-  ctx: { endpoint?: EndpointInfo } = {},
-): SecurityFinding {
-  const status = resp.status;
-  const echo = classifyEcho(resp.body_parsed ?? resp.body, payload, hit.class);
-  const echoed = echo.matched;
-
-  if (status >= 500) {
-    // ARV-250: 5xx on attack payload is a reliability signal, not a
-    // proven security issue. Single-signal proof (one crashed response)
-    // caps severity at LOW per the m-21 severity matrix. ARV-251
-    // relocates this signal to the reliability category; the existing
-    // `not_a_server_error` check already tracks 5xx on positive input,
-    // so the security probe here is a secondary signal at best.
-    return {
-      field: hit.field,
-      class: hit.class,
-      payload,
-      status,
-      echoed,
-      severity: "low",
-      reason: `5xx unhandled — server crashed on ${hit.class} payload (reliability signal; see also not_a_server_error check)`,
-    };
-  }
-  if (status >= 200 && status < 300) {
-    // ARV-253: CRLF severity now keyed on reflection context, not on
-    // raw echo. The pivot principle: HIGH requires evidence the stored
-    // payload reaches a dangerous rendering context (header value /
-    // unescaped HTML). Echo in a JSON body alone is single_signal —
-    // storage is real, exploit pathway is not. Caps at LOW.
-    if (hit.class === "crlf") {
-      const headerName = reflectsInHeaders(payload, resp.headers);
-      if (headerName) {
-        return {
-          field: hit.field,
-          class: hit.class,
-          payload,
-          status,
-          echoed: true,
-          severity: "high",
-          reason: `payload reflected in response header \`${headerName}\` — response-splitting / header-injection candidate (evidence_chain)`,
-        };
-      }
-      if (echoed && isHtmlContentType(resp.headers)) {
-        return {
-          field: hit.field,
-          class: hit.class,
-          payload,
-          status,
-          echoed,
-          severity: "high",
-          reason: `payload echoed (${echo.kind}) in text/html response — unescaped reflection candidate (evidence_chain)`,
-        };
-      }
-      if (echoed) {
-        return {
-          field: hit.field,
-          class: hit.class,
-          payload,
-          status,
-          echoed,
-          severity: "low",
-          reason: `payload echoed (${echo.kind}) in JSON body — storage observed, no dangerous-context reflection. Manual follow-up: check whether the stored value reaches a downstream renderer (HTML page, RSS, custom header).`,
-        };
-      }
-      return {
-        field: hit.field,
-        class: hit.class,
-        payload,
-        status,
-        echoed: false,
-        severity: "info",
-        reason: `${status} accepted ${hit.class} payload but no reflection observed — sanitization may be missing but no exploit pathway proven`,
-      };
-    }
-    // ARV-254: SSRF / open-redirect severity rebalance.
-    //
-    // Without an out-of-band (OOB) channel zond can't prove the server
-    // actually fetched the injected URL. "API accepted 169.254" is
-    // single_signal proof — caps at LOW per the m-21 matrix.
-    //
-    // Stake-raising signal: when the spec declares delivery semantics
-    // (path/tag mentions webhook / callback / subscription), the server
-    // is documented to fetch the URL — surface MEDIUM. Full HIGH is
-    // gated on OOB confirmation which lands with ARV-177 (deferred-
-    // post-pivot, out of scope for now).
-    const declaresDelivery = endpointDeclaresDelivery(ctx.endpoint);
-    const oobDisclaimer = "no OOB channel — accept ≠ proven fetch. Verify with Burp Collaborator / interactsh manually for HIGH severity.";
-    if (echoed) {
-      const label = echo.kind === "verbatim"
-        ? "payload echoed verbatim"
-        : `payload echoed (${echo.kind})`;
-      if (declaresDelivery) {
-        return {
-          field: hit.field,
-          class: hit.class,
-          payload,
-          status,
-          echoed,
-          severity: "low",
-          reason: `${label}; ${hit.class}: endpoint declares delivery (webhook/callback) but ${oobDisclaimer}`,
-        };
-      }
-      return {
-        field: hit.field,
-        class: hit.class,
-        payload,
-        status,
-        echoed,
-        severity: "low",
-        reason: `${label} — stored ${hit.class} candidate; ${oobDisclaimer}`,
-      };
-    }
-    if (declaresDelivery) {
-      return {
-        field: hit.field,
-        class: hit.class,
-        payload,
-        status,
-        echoed,
-        severity: "medium",
-        reason: `2xx accepted ${hit.class} payload on endpoint declaring delivery semantics (webhook/callback). ${oobDisclaimer}`,
-      };
-    }
-    return {
-      field: hit.field,
-      class: hit.class,
-      payload,
-      status,
-      echoed,
-      severity: "low",
-      reason: `2xx accepted ${hit.class} payload but no echo observed. ${oobDisclaimer}`,
-    };
-  }
-  if (status >= 400) {
-    return {
-      field: hit.field,
-      class: hit.class,
-      payload,
-      status,
-      echoed,
-      severity: "ok",
-      reason: `${status} rejected — ${hit.class} payload refused`,
-    };
-  }
-  return {
-    field: hit.field,
-    class: hit.class,
-    payload,
-    status,
-    echoed,
-    severity: "inconclusive",
-    reason: `unexpected status ${status}`,
-  };
-}
-
-function bodyToString(body: unknown): string {
-  if (!body) return "";
-  if (typeof body === "string") return body;
-  // Walk object/array, concatenating raw string leaves so CR/LF chars aren't
-  // hidden behind JSON escape sequences (\r → "\\r" after JSON.stringify).
-  const parts: string[] = [];
-  const seen = new WeakSet<object>();
-  const visit = (v: unknown): void => {
-    if (typeof v === "string") parts.push(v);
-    else if (v && typeof v === "object") {
-      if (seen.has(v as object)) return;
-      seen.add(v as object);
-      if (Array.isArray(v)) v.forEach(visit);
-      else for (const k of Object.keys(v as object)) visit((v as Record<string, unknown>)[k]);
-    }
-  };
-  try {
-    visit(body);
-  } catch {
-    return "";
-  }
-  return parts.join("\n");
-}
-
-function safeDecodeURI(s: string): string {
-  try {
-    return decodeURIComponent(s);
-  } catch {
-    return s;
-  }
-}
-
-type EchoKind =
-  | "verbatim"
-  | "url-decoded"
-  | "CR stripped"
-  | "LF stripped"
-  | "CRLF→LF"
-  | "CRLF→CR"
-  | "tail after CRLF";
-
-export interface EchoResult {
-  matched: boolean;
-  kind: EchoKind | "none";
-}
-
-export function classifyEcho(body: unknown, payload: string, cls: SecurityClass): EchoResult {
-  if (!payload) return { matched: false, kind: "none" };
-  const haystackRaw = bodyToString(body);
-  if (!haystackRaw) return { matched: false, kind: "none" };
-
-  // SSRF / open-redirect: verbatim only — URLs are usually preserved as-is.
-  if (cls !== "crlf") {
-    return haystackRaw.includes(payload)
-      ? { matched: true, kind: "verbatim" }
-      : { matched: false, kind: "none" };
-  }
-
-  // CRLF: try verbatim → URL-decode pairs → CR/LF normalization variants → tail.
-  if (haystackRaw.includes(payload)) return { matched: true, kind: "verbatim" };
-
-  const haystackDecoded = safeDecodeURI(haystackRaw);
-  const payloadDecoded = safeDecodeURI(payload);
-
-  if (
-    (payloadDecoded !== payload && haystackRaw.includes(payloadDecoded)) ||
-    (haystackDecoded !== haystackRaw && haystackDecoded.includes(payload)) ||
-    (payloadDecoded !== payload && haystackDecoded !== haystackRaw && haystackDecoded.includes(payloadDecoded))
-  ) {
-    return { matched: true, kind: "url-decoded" };
-  }
-
-  // Normalize: try variants of payload where backend stripped CR or LF.
-  const variants: Array<[string, EchoKind]> = [];
-  if (payloadDecoded.includes("\r\n")) {
-    variants.push([payloadDecoded.replace(/\r\n/g, "\n"), "CRLF→LF"]);
-    variants.push([payloadDecoded.replace(/\r\n/g, "\r"), "CRLF→CR"]);
-    variants.push([payloadDecoded.replace(/\r\n/g, ""), "CRLF→LF"]);
-  }
-  if (payloadDecoded.includes("\r")) variants.push([payloadDecoded.replace(/\r/g, ""), "CR stripped"]);
-  if (payloadDecoded.includes("\n")) variants.push([payloadDecoded.replace(/\n/g, ""), "LF stripped"]);
-
-  for (const [variant, kind] of variants) {
-    if (variant && variant !== payloadDecoded && (haystackRaw.includes(variant) || haystackDecoded.includes(variant))) {
-      return { matched: true, kind };
-    }
-  }
-
-  // Tail-substring: parser truncated at newline, only suffix landed in storage.
-  const splitMatch = payloadDecoded.match(/(?:\r\n|%0d%0a|%0a|%0d|\r|\n)(.+)$/i);
-  const tail = splitMatch?.[1];
-  if (tail && tail.length >= 3 && (haystackRaw.includes(tail) || haystackDecoded.includes(tail))) {
-    return { matched: true, kind: "tail after CRLF" };
-  }
-
-  return { matched: false, kind: "none" };
-}

package/src/core/probe/security/cleanup.ts

@@ -1,125 +0,0 @@
-import type { EndpointInfo, SecuritySchemeInfo } from "../../generator/types.ts";
-import { executeRequest } from "../../runner/http-client.ts";
-import {
-  captureFieldFor,
-  findDeleteCounterpart,
-  liveAuthHeaders,
-} from "../shared.ts";
-import type { ProbeStepOpts, SecurityVerdict } from "./types.ts";
-import { joinBaseAndPath } from "../../util/url.ts";
-
-/**
- * Best-effort DELETE on stateful endpoints after a successful baseline /
- * attack. Handles eventual-consistency retries (round-5) and persists
- * id/deletePath on the verdict so `zond cleanup --orphans` can replay
- * the DELETE without re-running the probe.
- */
-export async function tryCleanup(
-  ep: EndpointInfo,
-  allEndpoints: EndpointInfo[],
-  schemes: SecuritySchemeInfo[],
-  vars: Record<string, string>,
-  responseBody: unknown,
-  verdict: SecurityVerdict,
-  opts: ProbeStepOpts,
-): Promise<void> {
-  const delEp = findDeleteCounterpart(ep, allEndpoints);
-  if (!delEp) {
-    // Surface the gap. Round-4 dogfooding: 3 DSN keys leaked from
-    // POST /keys/ silently because the spec didn't expose a DELETE
-    // counterpart — flagging it in the digest gives the operator a
-    // chance to clean up by hand instead of finding out later.
-    accumulateCleanupError(verdict, `no DELETE counterpart for ${ep.method.toUpperCase()} ${ep.path}; possible leaked resource`);
-    return;
-  }
-  const idField = captureFieldFor(ep);
-  const id = pickId(responseBody, idField);
-  if (!id) {
-    accumulateCleanupError(verdict, `cleanup skipped: response had no usable id for ${ep.method.toUpperCase()} ${ep.path}`);
-    return;
-  }
-  // DELETE path has one path-param at the end; replace it with the captured id.
-  const concretePath = delEp.path.replace(/\{[^}]+\}/, encodeURIComponent(String(id)));
-  const url = joinBaseAndPath(vars["base_url"], concretePath);
-  const headers = liveAuthHeaders(delEp, schemes, vars);
-
-  // TASK-278: stash id + deletePath on the verdict so the orphan tracker
-  // (and `zond cleanup --orphans`) can replay this DELETE without re-running
-  // the probe. Done before retries so even an aborted run leaves a trace.
-  {
-    const prior = verdict.cleanup ?? { attempted: false };
-    verdict.cleanup = {
-      ...prior,
-      attempted: prior.attempted || true,
-      id,
-      deletePath: concretePath,
-    };
-  }
-
-  // Eventual-consistency retry (round-5 follow-up): POST creates on the
-  // write replica, immediate DELETE hits a read replica that hasn't seen
-  // the new id yet → 404. Two short backoffs swallow that transient
-  // 404; a 404 that survives the backoff is a real leak and lands in
-  // verdict.cleanup.error. Only 404 is retried — 5xx, network errors,
-  // 401/403 fail fast (the situation isn't going to improve).
-  const RETRY_DELAYS_MS = opts.cleanupRetryDelaysMs ?? [200, 1000];
-  let lastResp: { status: number } | null = null;
-  let lastNetErr: string | null = null;
-  for (let attempt = 0; attempt <= RETRY_DELAYS_MS.length; attempt++) {
-    if (attempt > 0) await new Promise(r => setTimeout(r, RETRY_DELAYS_MS[attempt - 1]!));
-    try {
-      const resp = await executeRequest(
-        { method: "DELETE", url, headers },
-        { timeout: opts.timeoutMs ?? 30000, retries: 0 },
-      );
-      lastResp = { status: resp.status };
-      if (resp.status >= 200 && resp.status < 300) {
-        const prior = verdict.cleanup ?? { attempted: false };
-        verdict.cleanup = {
-          attempted: true,
-          status: resp.status,
-          ...(prior.error ? { error: prior.error } : {}),
-          ...(prior.id !== undefined ? { id: prior.id } : {}),
-          ...(prior.deletePath ? { deletePath: prior.deletePath } : {}),
-        };
-        return;
-      }
-      // Only retry transient 404 (eventual-consistency window).
-      if (resp.status !== 404) break;
-    } catch (err) {
-      lastNetErr = err instanceof Error ? err.message : String(err);
-      // Network errors are not retried — they're not transient in the
-      // eventual-consistency sense (they're config/connectivity issues).
-      break;
-    }
-  }
-
-  if (lastNetErr) {
-    accumulateCleanupError(verdict, `DELETE ${delEp.path} network error: ${lastNetErr}`);
-  } else if (lastResp) {
-    const tail = lastResp.status === 404 ? " (persisted across retries — likely real leak)" : "";
-    accumulateCleanupError(verdict, `DELETE ${delEp.path} → ${lastResp.status} (id=${id})${tail}`);
-  }
-}
-
-function accumulateCleanupError(verdict: SecurityVerdict, msg: string): void {
-  const prior = verdict.cleanup ?? { attempted: false };
-  const errors = prior.error ? `${prior.error} | ${msg}` : msg;
-  verdict.cleanup = {
-    attempted: true,
-    ...(prior.status ? { status: prior.status } : {}),
-    ...(prior.id !== undefined ? { id: prior.id } : {}),
-    ...(prior.deletePath ? { deletePath: prior.deletePath } : {}),
-    error: errors,
-  };
-}
-
-function pickId(body: unknown, field: string): string | number | undefined {
-  if (!body || typeof body !== "object") return undefined;
-  const obj = body as Record<string, unknown>;
-  for (const key of [field, "id", "slug", "uuid", "key"]) {
-    const v = obj[key];
-    if (typeof v === "string" || typeof v === "number") return v;
-  }
-  return undefined;
-}

package/src/core/probe/security/detectors.ts

@@ -1,71 +0,0 @@
-import type { OpenAPIV3 } from "openapi-types";
-import type { EndpointInfo } from "../../generator/types.ts";
-import type { SecurityClass, SecurityFieldHit } from "./types.ts";
-
-// ARV-310: SSRF only targets URL-shaped field names — url / *_url / *_uri /
-// href / endpoint. Dropped the unanchored `webhook` / `callback` substrings
-// that matched free-text fields (e.g. `callback_message`, and grouped
-// `description` hits) which are not request-forgeable sinks. Schema
-// format=uri|url still qualifies a field regardless of name.
-const SSRF_NAME_RE =
-  /(url$|uri$|^href$|^endpoint$)/i;
-// ARV-310: CRLF targets header-reflected / redirect-shaped fields (email
-// Subject, log prefix, redirect targets), NOT free-text body fields. Dropped
-// `^name$` / `^title$` / `^description$` / `^tag$` — those are not header
-// sinks and produced the bulk of the GitHub-scan false positives
-// (name ×37, name,description ×22, title ×9).
-const CRLF_NAME_RE =
-  /(^subject$|^message_subject$|prefix$|^location$|^redirect$)/i;
-const OPEN_REDIRECT_NAME_RE =
-  /(^redirect$|^next$|^return_to$|^redirect_url$|^redirect_to$|^redirectTo$)/i;
-
-function matchesClass(
-  cls: SecurityClass,
-  name: string,
-  schema: OpenAPIV3.SchemaObject,
-): boolean {
-  // Skip enum-bounded fields — payload would obviously fail validation
-  // and we'd just waste requests on guaranteed-4xx attempts.
-  if (Array.isArray(schema.enum) && schema.enum.length > 0) return false;
-  if (schema.type !== "string" && schema.type !== undefined) return false;
-  switch (cls) {
-    case "ssrf":
-      return SSRF_NAME_RE.test(name) || schema.format === "uri" || schema.format === "url";
-    case "crlf":
-      return CRLF_NAME_RE.test(name);
-    case "open-redirect":
-      return OPEN_REDIRECT_NAME_RE.test(name);
-  }
-}
-
-export function detectFields(
-  ep: EndpointInfo,
-  classes: SecurityClass[],
-): SecurityFieldHit[] {
-  const out: SecurityFieldHit[] = [];
-  const schema = ep.requestBodySchema;
-  if (!schema || !schema.properties) return out;
-  for (const [name, propSchema] of Object.entries(schema.properties)) {
-    const s = propSchema as OpenAPIV3.SchemaObject;
-    for (const cls of classes) {
-      if (matchesClass(cls, name, s)) out.push({ field: name, class: cls });
-    }
-  }
-  return out;
-}
-
-export const PAYLOADS: Record<SecurityClass, string[]> = {
-  ssrf: [
-    "http://127.0.0.1:80/",
-    "http://169.254.169.254/latest/meta-data/",
-    "file:///etc/passwd",
-  ],
-  crlf: [
-    "zond-safe\r\nX-Zond-Injected: yes",
-    "zond-safe%0d%0aX-Zond-Injected: yes",
-  ],
-  "open-redirect": [
-    "https://zond-attacker.example.tld",
-    "//zond-attacker.example.tld",
-  ],
-};

package/src/core/probe/security/digest.ts

@@ -1,104 +0,0 @@
-import type {
-  SecurityProbeResult,
-  SecuritySeverity,
-  SecurityVerdict,
-} from "./types.ts";
-import { encodePathForRepro } from "../shared.ts";
-
-/** TASK-154 §N: clip noisy payloads (some SSRF/CRLF/redirect strings are URL-
- *  encoded blobs > 60 chars). Keep the leading prefix users recognise plus an
- *  ellipsis, so the digest line stays readable. */
-function truncatePayload(payload: string, max: number): string {
-  if (payload.length <= max) return payload;
-  return payload.slice(0, max - 1) + "…";
-}
-
-export function formatSecurityDigest(
-  result: SecurityProbeResult,
-  specPath: string,
-): string {
-  const lines: string[] = [];
-  lines.push(`# zond probe-security digest`);
-  lines.push("");
-  lines.push(`Spec: \`${specPath}\``);
-  lines.push(`Classes: ${result.classes.join(", ")}`);
-  lines.push(`Endpoints scanned: ${result.totalEndpoints} · probed: ${result.specProbed}`);
-  // ARV-140 AC#4: surface the cleanup-feasibility outcome up front so a
-  // green run doesn't hide "we attacked 14 leak-prone POSTs anyway".
-  if (result.cleanupFeasibility) {
-    const f = result.cleanupFeasibility;
-    if (f.skippedNoCleanup > 0) {
-      lines.push(`Cleanup pre-flight: ${f.skippedNoCleanup} endpoint(s) skipped (no DELETE counterpart). Pass \`--allow-leaks\` to attack anyway.`);
-    } else if (f.forcedNoCleanup > 0) {
-      lines.push(`Cleanup pre-flight: ${f.forcedNoCleanup} endpoint(s) attacked despite no DELETE counterpart (--allow-leaks).`);
-    }
-    // ARV-153: surface action-verb POSTs we now attack without a DELETE
-    // counterpart so green runs make the recall win visible.
-    if (f.actionNoCleanupNeeded > 0) {
-      lines.push(`Cleanup pre-flight: ${f.actionNoCleanupNeeded} action POST(s) attacked (no resource created — DELETE counterpart not needed).`);
-    }
-  }
-  lines.push("");
-
-  // Cleanup failures section is mandatory and goes FIRST when present —
-  // round-4 dogfooding: a "green" run (HIGH=0) silently leaked DSN keys
-  // and left renamed projects, because cleanup failures were buried in
-  // per-verdict objects. Surface them prominently so a green probe is a
-  // signal the org is clean, not just that nothing crashed.
-  const cleanupFailures = result.verdicts.filter(v => v.cleanup?.error);
-  if (cleanupFailures.length > 0) {
-    lines.push(`## ⚠️ Cleanup failures (${cleanupFailures.length}) — manual remediation may be required`);
-    lines.push("");
-    for (const v of cleanupFailures) {
-      lines.push(`- **${v.method} ${v.path}** — ${v.cleanup!.error}`);
-      // ARV-245 (R-04/F16): paste-ready manual repro when we have a
-      // deletePath. Auto-encode the path so operators dealing with
-      // CRLF-poisoned ids (round-4 GitHub labels) don't have to remember
-      // to percent-encode `\r`/`\n`/spaces themselves.
-      const dp = v.cleanup?.deletePath;
-      if (dp) {
-        const encoded = encodePathForRepro(dp);
-        const note = /[\r\n\t ]/.test(dp) ? " (note: id contains whitespace/CRLF — percent-encoded)" : "";
-        lines.push(`  - Manual repro: \`zond request DELETE ${encoded} --api <name>\`${note}`);
-      }
-    }
-    lines.push("");
-  }
-
-  const buckets: Record<SecuritySeverity, SecurityVerdict[]> = {
-    high: [], medium: [], low: [], info: [], inconclusive: [], "inconclusive-baseline": [], ok: [], skipped: [],
-  };
-  for (const v of result.verdicts) buckets[v.severity].push(v);
-
-  const ordered: SecuritySeverity[] = ["high", "inconclusive", "inconclusive-baseline", "medium", "low", "info", "ok", "skipped"];
-  const titles: Record<SecuritySeverity, string> = {
-    high: "🚨 HIGH — header-reflection / HTML reflection / 5xx",
-    medium: "⚠️ MEDIUM — SSRF accept on endpoint declaring delivery (no OOB confirmation)",
-    low: "🟡 LOW — storage observed, no dangerous-context reflection (verify manually)",
-    info: "·  INFO — accepted, no reflection observed (sanitization signal only)",
-    inconclusive: "❓ INCONCLUSIVE — could not classify",
-    "inconclusive-baseline": "⚠️ INCONCLUSIVE-BASELINE — baseline 4xx, attacks not run",
-    ok: "✅ OK — payloads rejected with 4xx",
-    skipped: "⏭️ SKIPPED — no detected fields / no body",
-  };
-  for (const sev of ordered) {
-    const list = buckets[sev];
-    if (list.length === 0) continue;
-    lines.push(`## ${titles[sev]} (${list.length})`);
-    lines.push("");
-    for (const v of list) {
-      const cleanupTag = v.cleanup?.error ? " 🧹 cleanup-failure" : "";
-      lines.push(`- **${v.method} ${v.path}**${cleanupTag} — ${v.summary}`);
-      for (const f of v.findings) {
-        // TASK-154 §N: surface the actual payload that triggered the finding
-        // — without it the digest is useless for case-study writing (which
-        // SSRF target? which CRLF shape?). Truncate long payloads so the
-        // line stays readable.
-        const payload = truncatePayload(f.payload, 60);
-        lines.push(`  - \`${f.field}\` / ${f.class} [\`${payload}\`] → ${f.status} (${f.severity}) — ${f.reason}`);
-      }
-    }
-    lines.push("");
-  }
-  return lines.join("\n");
-}