agentic-qe 3.15.9 → 3.15.10

package/dist/domains/security-compliance/plugin.js

@@ -4,6 +4,8 @@
  */
 import { err } from '../../shared/types/index.js';
 import { BaseDomainPlugin } from '../domain-interface.js';
+import { FilePath } from '../../shared/value-objects/index.js';
+import { confineSastFiles, MAX_SAST_FILE_BYTES } from './sast-path-guard.js';
 import { SecurityComplianceCoordinator, } from './coordinator.js';
 import { SecurityScannerService, } from './services/security-scanner.js';
 import { SecurityAuditorService, } from './services/security-auditor.js';
@@ -97,11 +99,23 @@ export class SecurityCompliancePlugin extends BaseDomainPlugin {
                     if (!this.securityScanner) {
                         return err(new Error('Security scanner not initialized'));
                     }
-                    const files = payload.files;
-                    if (!files || files.length === 0) {
+                    const requested = payload.files;
+                    if (!requested || requested.length === 0) {
                         return err(new Error('Invalid sast-scan payload: missing files'));
                     }
-                    return this.securityScanner.scanFiles(files);
+                    // #1125: a payload that crossed a JSON boundary (task_submit,
+                    // task_orchestrate, fleet run) carries plain path strings.
+                    if (requested.some(f => typeof f === 'string' ? f.trim() === '' : !(f instanceof FilePath))) {
+                        return err(new Error('Invalid sast-scan payload: files must be non-empty file paths'));
+                    }
+                    // Every file must be a regular file inside the project, within the
+                    // size limit; otherwise nothing is read.
+                    const { accepted, skipped } = await confineSastFiles(requested.map(f => typeof f === 'string' ? f : f.value));
+                    if (skipped.length > 0) {
+                        return err(new Error(`Invalid sast-scan payload: these files cannot be scanned: ${skipped.map(s => `${s.path} (${s.reason})`).join(', ')}. ` +
+                            `Pass regular files inside the project, at most ${MAX_SAST_FILE_BYTES / (1024 * 1024)} MB each.`));
+                    }
+                    return this.securityScanner.scanFiles(accepted.map(f => FilePath.create(f)));
                 }],
             ['dast-scan', async (payload) => {
                     if (!this.securityScanner) {

package/dist/domains/security-compliance/sast-path-guard.d.ts

@@ -0,0 +1,9 @@
+import { type SkippedPayloadPath } from '../../shared/io/payload-path-guard.js';
+/** Largest file the pattern scanner reads whole into memory. */
+export declare const MAX_SAST_FILE_BYTES: number;
+export interface ConfinedSastFiles {
+    accepted: string[];
+    skipped: SkippedPayloadPath[];
+}
+export declare function confineSastFiles(paths: readonly string[], projectRoot?: string): Promise<ConfinedSastFiles>;
+//# sourceMappingURL=sast-path-guard.d.ts.map

package/dist/domains/security-compliance/sast-path-guard.js

@@ -0,0 +1,17 @@
+/**
+ * #1125 review: decide which requested files the sast-scan task may read.
+ *
+ * The task reads every file it is given. Its payload can come from MCP
+ * task_submit, so the same rule as code indexing (#1096) applies: a file is
+ * scanned only when its realpath is a regular file inside the project root's
+ * realpath. A symlink out of the project, a device such as /dev/zero or a
+ * directory is refused by name, and so is a file over the size limit.
+ */
+import { findProjectRoot } from '../../kernel/project-root.js';
+import { confinePayloadPaths, MAX_PAYLOAD_FILE_BYTES, } from '../../shared/io/payload-path-guard.js';
+/** Largest file the pattern scanner reads whole into memory. */
+export const MAX_SAST_FILE_BYTES = MAX_PAYLOAD_FILE_BYTES;
+export async function confineSastFiles(paths, projectRoot = findProjectRoot()) {
+    return confinePayloadPaths(paths, { projectRoot, maxBytes: MAX_SAST_FILE_BYTES });
+}
+//# sourceMappingURL=sast-path-guard.js.map

package/dist/domains/security-compliance/services/scanners/dast-auth-testing.js

@@ -21,43 +21,38 @@ export async function testAuthorizationBypass(parsedUrl, authHeaders, crawledUrl
     for (const endpoint of protectedEndpoints) {
         if (crawledUrls >= maxDepth * 15)
             break;
-        try {
-            const testUrl = new URL(endpoint, parsedUrl.origin).toString();
-            // Try with authentication
-            const authResponse = await fetch(testUrl, {
+        const testUrl = new URL(endpoint, parsedUrl.origin).toString();
+        // Try with authentication
+        const authResponse = await fetch(testUrl, {
+            method: 'GET',
+            headers: { ...authHeaders },
+            signal: AbortSignal.timeout(5000),
+        });
+        if (authResponse.ok) {
+            crawledUrls++;
+            // Try without authentication
+            const unauthResponse = await fetch(testUrl, {
                 method: 'GET',
-                headers: { ...authHeaders },
                 signal: AbortSignal.timeout(5000),
             });
-            if (authResponse.ok) {
-                crawledUrls++;
-                // Try without authentication
-                const unauthResponse = await fetch(testUrl, {
-                    method: 'GET',
-                    signal: AbortSignal.timeout(5000),
-                });
-                if (unauthResponse.ok && unauthResponse.status === 200) {
-                    const authText = await authResponse.text();
-                    const unauthText = await unauthResponse.text();
-                    if (authText.length > 100 && unauthText.length > 100 &&
-                        Math.abs(authText.length - unauthText.length) < authText.length * 0.1) {
-                        vulnerabilities.push({
-                            id: uuidv4(),
-                            title: 'Missing Authentication on Protected Endpoint',
-                            description: `Endpoint ${endpoint} is accessible without authentication`,
-                            severity: 'high',
-                            category: 'broken-auth',
-                            location: { file: testUrl },
-                            remediation: { description: 'Implement proper authentication checks', estimatedEffort: 'moderate', automatable: false },
-                            references: ['https://owasp.org/www-project-web-security-testing-guide/'],
-                        });
-                    }
+            if (unauthResponse.ok && unauthResponse.status === 200) {
+                const authText = await authResponse.text();
+                const unauthText = await unauthResponse.text();
+                if (authText.length > 100 && unauthText.length > 100 &&
+                    Math.abs(authText.length - unauthText.length) < authText.length * 0.1) {
+                    vulnerabilities.push({
+                        id: uuidv4(),
+                        title: 'Missing Authentication on Protected Endpoint',
+                        description: `Endpoint ${endpoint} is accessible without authentication`,
+                        severity: 'high',
+                        category: 'broken-auth',
+                        location: { file: testUrl },
+                        remediation: { description: 'Implement proper authentication checks', estimatedEffort: 'moderate', automatable: false },
+                        references: ['https://owasp.org/www-project-web-security-testing-guide/'],
+                    });
                 }
             }
         }
-        catch {
-            // Endpoint not accessible - expected
-        }
     }
     return crawledUrls;
 }
@@ -74,33 +69,28 @@ export async function testIDOR(parsedUrl, authHeaders, crawledUrls, maxDepth, vu
     for (const endpoint of idorEndpoints.slice(0, 2)) {
         if (crawledUrls >= maxDepth * 15)
             break;
-        try {
-            const testUrl = new URL(endpoint, parsedUrl.origin).toString();
-            const response = await fetch(testUrl, {
-                method: 'GET',
-                headers: { ...authHeaders },
-                signal: AbortSignal.timeout(5000),
-            });
-            if (response.ok) {
-                crawledUrls++;
-                const text = await response.text();
-                if (text.includes('email') || text.includes('password') || text.includes('phone')) {
-                    vulnerabilities.push({
-                        id: uuidv4(),
-                        title: 'Potential Insecure Direct Object Reference (IDOR)',
-                        description: `Endpoint ${endpoint} may expose other users' data`,
-                        severity: 'high',
-                        category: 'access-control',
-                        location: { file: testUrl },
-                        remediation: { description: 'Implement proper authorization checks for resource access', estimatedEffort: 'moderate', automatable: false },
-                        references: ['https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/05-Authorization_Testing/04-Testing_for_Insecure_Direct_Object_References'],
-                    });
-                }
+        const testUrl = new URL(endpoint, parsedUrl.origin).toString();
+        const response = await fetch(testUrl, {
+            method: 'GET',
+            headers: { ...authHeaders },
+            signal: AbortSignal.timeout(5000),
+        });
+        if (response.ok) {
+            crawledUrls++;
+            const text = await response.text();
+            if (text.includes('email') || text.includes('password') || text.includes('phone')) {
+                vulnerabilities.push({
+                    id: uuidv4(),
+                    title: 'Potential Insecure Direct Object Reference (IDOR)',
+                    description: `Endpoint ${endpoint} may expose other users' data`,
+                    severity: 'high',
+                    category: 'access-control',
+                    location: { file: testUrl },
+                    remediation: { description: 'Implement proper authorization checks for resource access', estimatedEffort: 'moderate', automatable: false },
+                    references: ['https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/05-Authorization_Testing/04-Testing_for_Insecure_Direct_Object_References'],
+                });
             }
         }
-        catch {
-            // Endpoint not accessible
-        }
     }
     return crawledUrls;
 }

package/dist/domains/security-compliance/services/scanners/dast-helpers.js

@@ -112,38 +112,33 @@ export async function scanSensitiveFiles(parsedUrl, crawledUrls, maxDepth, vulne
     for (const endpoint of sensitiveEndpoints) {
         if (crawledUrls >= maxDepth * 10)
             break;
-        try {
-            const testUrl = new URL(endpoint.path, parsedUrl.origin).toString();
-            const testResponse = await fetch(testUrl, {
-                method: 'GET',
-                signal: AbortSignal.timeout(5000),
-            });
-            if (testResponse.ok) {
-                crawledUrls++;
-                const text = await testResponse.text();
-                if (text.length > 20 && !text.toLowerCase().includes('not found') && !text.toLowerCase().includes('404')) {
-                    const isSensitive = endpoint.path.includes('.git') ||
-                        endpoint.path.includes('.env') ||
-                        endpoint.path.includes('.htaccess') ||
-                        endpoint.path.includes('web.config');
-                    if (isSensitive) {
-                        vulnerabilities.push({
-                            id: uuidv4(),
-                            title: `Sensitive File Exposed: ${endpoint.name}`,
-                            description: `${endpoint.name} is publicly accessible`,
-                            severity: endpoint.path.includes('.git') || endpoint.path.includes('.env') ? 'high' : 'medium',
-                            category: 'sensitive-data',
-                            location: { file: testUrl },
-                            remediation: { description: `Restrict access to ${endpoint.path}`, estimatedEffort: 'trivial', automatable: true },
-                            references: ['https://owasp.org/www-project-web-security-testing-guide/'],
-                        });
-                    }
+        const testUrl = new URL(endpoint.path, parsedUrl.origin).toString();
+        const testResponse = await fetch(testUrl, {
+            method: 'GET',
+            signal: AbortSignal.timeout(5000),
+        });
+        if (testResponse.ok) {
+            crawledUrls++;
+            const text = await testResponse.text();
+            if (text.length > 20 && !text.toLowerCase().includes('not found') && !text.toLowerCase().includes('404')) {
+                const isSensitive = endpoint.path.includes('.git') ||
+                    endpoint.path.includes('.env') ||
+                    endpoint.path.includes('.htaccess') ||
+                    endpoint.path.includes('web.config');
+                if (isSensitive) {
+                    vulnerabilities.push({
+                        id: uuidv4(),
+                        title: `Sensitive File Exposed: ${endpoint.name}`,
+                        description: `${endpoint.name} is publicly accessible`,
+                        severity: endpoint.path.includes('.git') || endpoint.path.includes('.env') ? 'high' : 'medium',
+                        category: 'sensitive-data',
+                        location: { file: testUrl },
+                        remediation: { description: `Restrict access to ${endpoint.path}`, estimatedEffort: 'trivial', automatable: true },
+                        references: ['https://owasp.org/www-project-web-security-testing-guide/'],
+                    });
                 }
             }
         }
-        catch {
-            // File not accessible - expected
-        }
     }
     return crawledUrls;
 }
@@ -154,31 +149,26 @@ export async function scanSensitiveFiles(parsedUrl, crawledUrls, maxDepth, vulne
  * Analyze CORS configuration
  */
 export async function analyzeCORS(targetUrl, vulnerabilities) {
-    try {
-        const corsResponse = await fetch(targetUrl, {
-            method: 'OPTIONS',
-            headers: {
-                'Origin': 'https://evil-attacker.com',
-                'Access-Control-Request-Method': 'GET',
-            },
-            signal: AbortSignal.timeout(5000),
+    const corsResponse = await fetch(targetUrl, {
+        method: 'OPTIONS',
+        headers: {
+            'Origin': 'https://evil-attacker.com',
+            'Access-Control-Request-Method': 'GET',
+        },
+        signal: AbortSignal.timeout(5000),
+    });
+    const allowOrigin = corsResponse.headers.get('access-control-allow-origin');
+    if (allowOrigin === '*' || allowOrigin === 'https://evil-attacker.com') {
+        vulnerabilities.push({
+            id: uuidv4(),
+            title: 'Overly Permissive CORS Policy',
+            description: allowOrigin === '*' ? 'CORS allows all origins' : 'CORS reflects arbitrary origin',
+            severity: 'medium',
+            category: 'access-control',
+            location: { file: targetUrl, snippet: `Access-Control-Allow-Origin: ${allowOrigin}` },
+            remediation: { description: 'Restrict CORS to specific trusted origins', estimatedEffort: 'minor', automatable: false },
+            references: ['https://owasp.org/www-community/attacks/CORS_OriginHeaderScrutiny'],
         });
-        const allowOrigin = corsResponse.headers.get('access-control-allow-origin');
-        if (allowOrigin === '*' || allowOrigin === 'https://evil-attacker.com') {
-            vulnerabilities.push({
-                id: uuidv4(),
-                title: 'Overly Permissive CORS Policy',
-                description: allowOrigin === '*' ? 'CORS allows all origins' : 'CORS reflects arbitrary origin',
-                severity: 'medium',
-                category: 'access-control',
-                location: { file: targetUrl, snippet: `Access-Control-Allow-Origin: ${allowOrigin}` },
-                remediation: { description: 'Restrict CORS to specific trusted origins', estimatedEffort: 'minor', automatable: false },
-                references: ['https://owasp.org/www-community/attacks/CORS_OriginHeaderScrutiny'],
-            });
-        }
-    }
-    catch {
-        // OPTIONS request failed - CORS might be properly restricted
     }
 }
 // ============================================================================
@@ -209,45 +199,40 @@ export async function extractAndCrawlLinks(html, baseUrl, currentCrawled, maxDep
     for (const path of linksToCrawl) {
         if (crawledUrls >= maxCrawl)
             break;
-        try {
-            const crawlUrl = new URL(path, baseUrl.origin).toString();
-            const crawlResponse = await fetch(crawlUrl, {
-                method: 'GET',
-                headers: { 'User-Agent': 'AgenticQE-DAST-Scanner/3.0' },
-                signal: AbortSignal.timeout(5000),
-                redirect: 'follow',
-            });
-            crawledUrls++;
-            if (crawlResponse.ok) {
-                if (path.includes('password') || path.includes('token') || path.includes('api_key')) {
-                    vulnerabilities.push({
-                        id: uuidv4(),
-                        title: 'Sensitive Data in URL Path',
-                        description: `URL path may contain sensitive parameter names: ${path}`,
-                        severity: 'medium',
-                        category: 'sensitive-data',
-                        location: { file: crawlUrl },
-                        remediation: { description: 'Avoid sensitive data in URL paths', estimatedEffort: 'minor', automatable: false },
-                        references: ['https://owasp.org/www-community/vulnerabilities/Information_exposure_through_query_strings_in_url'],
-                    });
-                }
-                const responseText = await crawlResponse.text();
-                if (responseText.includes('Index of /') || responseText.includes('Directory listing for')) {
-                    vulnerabilities.push({
-                        id: uuidv4(),
-                        title: 'Directory Listing Enabled',
-                        description: `Directory listing is enabled at: ${crawlUrl}`,
-                        severity: 'medium',
-                        category: 'security-misconfiguration',
-                        location: { file: crawlUrl },
-                        remediation: { description: 'Disable directory listing in server configuration', estimatedEffort: 'trivial', automatable: true },
-                        references: ['https://owasp.org/www-project-web-security-testing-guide/'],
-                    });
-                }
+        const crawlUrl = new URL(path, baseUrl.origin).toString();
+        const crawlResponse = await fetch(crawlUrl, {
+            method: 'GET',
+            headers: { 'User-Agent': 'AgenticQE-DAST-Scanner/3.0' },
+            signal: AbortSignal.timeout(5000),
+            redirect: 'follow',
+        });
+        crawledUrls++;
+        if (crawlResponse.ok) {
+            if (path.includes('password') || path.includes('token') || path.includes('api_key')) {
+                vulnerabilities.push({
+                    id: uuidv4(),
+                    title: 'Sensitive Data in URL Path',
+                    description: `URL path may contain sensitive parameter names: ${path}`,
+                    severity: 'medium',
+                    category: 'sensitive-data',
+                    location: { file: crawlUrl },
+                    remediation: { description: 'Avoid sensitive data in URL paths', estimatedEffort: 'minor', automatable: false },
+                    references: ['https://owasp.org/www-community/vulnerabilities/Information_exposure_through_query_strings_in_url'],
+                });
+            }
+            const responseText = await crawlResponse.text();
+            if (responseText.includes('Index of /') || responseText.includes('Directory listing for')) {
+                vulnerabilities.push({
+                    id: uuidv4(),
+                    title: 'Directory Listing Enabled',
+                    description: `Directory listing is enabled at: ${crawlUrl}`,
+                    severity: 'medium',
+                    category: 'security-misconfiguration',
+                    location: { file: crawlUrl },
+                    remediation: { description: 'Disable directory listing in server configuration', estimatedEffort: 'trivial', automatable: true },
+                    references: ['https://owasp.org/www-project-web-security-testing-guide/'],
+                });
             }
-        }
-        catch {
-            // Page not accessible
         }
     }
     return crawledUrls;

package/dist/domains/security-compliance/services/scanners/dast-injection-testing.js

@@ -11,43 +11,38 @@ import { v4 as uuidv4 } from 'uuid';
  */
 export async function testXSS(targetUrl, parsedUrl, paramName, payloads, vulnerabilities) {
     for (const xss of payloads) {
-        try {
-            const testParams = new URLSearchParams(parsedUrl.search);
-            testParams.set(paramName, xss.payload);
-            const testUrl = `${parsedUrl.origin}${parsedUrl.pathname}?${testParams.toString()}`;
-            const response = await fetch(testUrl, {
-                method: 'GET',
-                headers: { 'User-Agent': 'AgenticQE-DAST-Scanner/3.0' },
-                signal: AbortSignal.timeout(5000),
-            });
-            if (response.ok) {
-                const text = await response.text();
-                const escapedPayload = xss.payload
-                    .replace(/&/g, '&')
-                    .replace(/</g, '&lt;')
-                    .replace(/>/g, '&gt;')
-                    .replace(/"/g, '&quot;')
-                    .replace(/'/g, '&#x27;');
-                const hasUnescapedPayload = text.includes(xss.payload);
-                const hasEscapedPayload = text.includes(escapedPayload);
-                if (hasUnescapedPayload && !hasEscapedPayload) {
-                    vulnerabilities.push({
-                        id: uuidv4(),
-                        title: `Reflected XSS: ${xss.name}`,
-                        description: `Parameter '${paramName}' reflects unsanitized input`,
-                        severity: 'critical',
-                        category: 'xss',
-                        location: { file: targetUrl, snippet: `Parameter: ${paramName}, Payload: ${xss.payload.substring(0, 30)}...` },
-                        remediation: { description: 'HTML-encode all user input before rendering', estimatedEffort: 'moderate', automatable: false },
-                        references: ['https://owasp.org/www-community/attacks/xss/'],
-                    });
-                    break;
-                }
+        const testParams = new URLSearchParams(parsedUrl.search);
+        testParams.set(paramName, xss.payload);
+        const testUrl = `${parsedUrl.origin}${parsedUrl.pathname}?${testParams.toString()}`;
+        const response = await fetch(testUrl, {
+            method: 'GET',
+            headers: { 'User-Agent': 'AgenticQE-DAST-Scanner/3.0' },
+            signal: AbortSignal.timeout(5000),
+        });
+        if (response.ok) {
+            const text = await response.text();
+            const escapedPayload = xss.payload
+                .replace(/&/g, '&amp;')
+                .replace(/</g, '&lt;')
+                .replace(/>/g, '&gt;')
+                .replace(/"/g, '&quot;')
+                .replace(/'/g, '&#x27;');
+            const hasUnescapedPayload = text.includes(xss.payload);
+            const hasEscapedPayload = text.includes(escapedPayload);
+            if (hasUnescapedPayload && !hasEscapedPayload) {
+                vulnerabilities.push({
+                    id: uuidv4(),
+                    title: `Reflected XSS: ${xss.name}`,
+                    description: `Parameter '${paramName}' reflects unsanitized input`,
+                    severity: 'critical',
+                    category: 'xss',
+                    location: { file: targetUrl, snippet: `Parameter: ${paramName}, Payload: ${xss.payload.substring(0, 30)}...` },
+                    remediation: { description: 'HTML-encode all user input before rendering', estimatedEffort: 'moderate', automatable: false },
+                    references: ['https://owasp.org/www-community/attacks/xss/'],
+                });
+                break;
             }
         }
-        catch {
-            // Request failed
-        }
     }
 }
 /**
@@ -65,35 +60,30 @@ export async function testSQLi(targetUrl, parsedUrl, paramName, payloads, vulner
         /quoted string not properly terminated/i,
     ];
     for (const sqli of payloads) {
-        try {
-            const testParams = new URLSearchParams(parsedUrl.search);
-            testParams.set(paramName, sqli.payload);
-            const testUrl = `${parsedUrl.origin}${parsedUrl.pathname}?${testParams.toString()}`;
-            const response = await fetch(testUrl, {
-                method: 'GET',
-                headers: { 'User-Agent': 'AgenticQE-DAST-Scanner/3.0' },
-                signal: AbortSignal.timeout(5000),
-            });
-            const text = await response.text();
-            for (const pattern of sqlErrorPatterns) {
-                if (pattern.test(text)) {
-                    vulnerabilities.push({
-                        id: uuidv4(),
-                        title: `SQL Injection: ${sqli.name}`,
-                        description: `Parameter '${paramName}' appears vulnerable to SQL injection`,
-                        severity: 'critical',
-                        category: 'injection',
-                        location: { file: targetUrl, snippet: `Parameter: ${paramName}` },
-                        remediation: { description: 'Use parameterized queries or prepared statements', estimatedEffort: 'moderate', automatable: false },
-                        references: ['https://owasp.org/www-community/attacks/SQL_Injection'],
-                    });
-                    break;
-                }
+        const testParams = new URLSearchParams(parsedUrl.search);
+        testParams.set(paramName, sqli.payload);
+        const testUrl = `${parsedUrl.origin}${parsedUrl.pathname}?${testParams.toString()}`;
+        const response = await fetch(testUrl, {
+            method: 'GET',
+            headers: { 'User-Agent': 'AgenticQE-DAST-Scanner/3.0' },
+            signal: AbortSignal.timeout(5000),
+        });
+        const text = await response.text();
+        for (const pattern of sqlErrorPatterns) {
+            if (pattern.test(text)) {
+                vulnerabilities.push({
+                    id: uuidv4(),
+                    title: `SQL Injection: ${sqli.name}`,
+                    description: `Parameter '${paramName}' appears vulnerable to SQL injection`,
+                    severity: 'critical',
+                    category: 'injection',
+                    location: { file: targetUrl, snippet: `Parameter: ${paramName}` },
+                    remediation: { description: 'Use parameterized queries or prepared statements', estimatedEffort: 'moderate', automatable: false },
+                    references: ['https://owasp.org/www-community/attacks/SQL_Injection'],
+                });
+                break;
             }
         }
-        catch {
-            // Request failed
-        }
     }
 }
 //# sourceMappingURL=dast-injection-testing.js.map

package/dist/domains/security-compliance/services/scanners/dast-scanner.d.ts

@@ -4,6 +4,27 @@
  */
 import { Result } from '@shared/types/index.js';
 import type { SecurityScannerConfig, DASTResult, DASTOptions, AuthCredentials, MemoryBackend, ScanStatus } from './scanner-types.js';
+/**
+ * DAST Scanner - Dynamic Application Security Testing
+ * Scans running applications for security vulnerabilities
+ *
+ * **Capabilities:**
+ * - Security header analysis (HSTS, CSP, X-Frame-Options, etc.)
+ * - Cookie security (Secure, HttpOnly, SameSite flags)
+ * - CORS misconfiguration detection
+ * - Sensitive file exposure (/.git, /.env, etc.)
+ * - Link crawling with same-origin scope
+ * - XSS reflection testing (GET parameters)
+ * - SQL injection error-based detection (GET parameters)
+ * - Form security analysis (CSRF tokens, autocomplete, action URLs)
+ *
+ * **Limitations:**
+ * - Injection testing: GET parameters only (POST form submission not implemented)
+ * - Crawling: Same-origin only, max 10 links per page, single depth
+ * - Auth flows: Header-based only, no login form automation
+ * - No JavaScript execution (static response analysis only)
+ * - No session management testing beyond cookie attributes
+ */
 export declare class DASTScanner {
     private readonly config;
     private readonly memory;
@@ -31,7 +52,6 @@ export declare class DASTScanner {
     private performAuthenticatedScan;
     private createInvalidUrlVuln;
     private createInsecureProtocolVuln;
-    private createAuthFailedVuln;
     private createTokenInUrlVuln;
     /**
      * Test URL parameters for injection vulnerabilities