claude-flow 3.25.6 → 3.26.0

package/.claude/security-scans/scan-all-standard.json

@@ -0,0 +1,321 @@
+{
+  "timestamp": "2026-07-13T15:25:27.667Z",
+  "target": ".",
+  "depth": "standard",
+  "type": "all",
+  "summary": {
+    "critical": 0,
+    "high": 43,
+    "medium": 8,
+    "low": 0,
+    "total": 51
+  },
+  "findings": [
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "ruflo/docker-compose.public.yml:21",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/browser/tests/security-integration.test.ts:168",
+      "description": "API Key (Stripe/OpenAI)"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/browser/tests/workflow-templates.test.ts:100",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/cli/__tests__/plugins-transfer-deep.test.ts:1261",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/cli/__tests__/plugins-transfer-deep.test.ts:1271",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/cli/__tests__/security-audit.test.ts:204",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/codex/tests/validators.test.ts:126",
+      "description": "API Key (Stripe/OpenAI)"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/codex/tests/validators.test.ts:148",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/guidance/src/analyzer.ts:1725",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/guidance/src/analyzer.ts:2732",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/guidance/src/manifest-validator.ts:984",
+      "description": "API Key (Stripe/OpenAI)"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/guidance/tests/analyzer.test.ts:1205",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/guidance/tests/analyzer.test.ts:1292",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/guidance/tests/analyzer.test.ts:2021",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/guidance/tests/gates.test.ts:137",
+      "description": "API Key (Stripe/OpenAI)"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/guidance/tests/gates.test.ts:144",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/guidance/tests/gates.test.ts:155",
+      "description": "GitHub Token"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/guidance/tests/gates.test.ts:160",
+      "description": "AWS Access Key"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/guidance/tests/gates.test.ts:175",
+      "description": "API Key (Stripe/OpenAI)"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/guidance/tests/gateway.test.ts:512",
+      "description": "API Key (Stripe/OpenAI)"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/guidance/tests/hooks.test.ts:297",
+      "description": "API Key (Stripe/OpenAI)"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/guidance/tests/hooks.test.ts:419",
+      "description": "GitHub Token"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/guidance/tests/integration.test.ts:109",
+      "description": "API Key (Stripe/OpenAI)"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/guidance/tests/wasm-kernel.test.ts:152",
+      "description": "API Key (Stripe/OpenAI)"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/guidance/tests/wasm-kernel.test.ts:335",
+      "description": "API Key (Stripe/OpenAI)"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/plugins/__tests__/ruvector-bridge.test.ts:129",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/security/__tests__/input-validator.test.ts:193",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/security/__tests__/input-validator.test.ts:200",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/security/__tests__/input-validator.test.ts:208",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/security/__tests__/input-validator.test.ts:218",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/security/__tests__/input-validator.test.ts:355",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/security/__tests__/password-hasher.test.ts:128",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/security/src/credential-generator.ts:324",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/security/src/credential-generator.ts:325",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/plugins/code-intelligence/tests/types.test.ts:526",
+      "description": "AWS Access Key"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/browser/tests/browser-service.test.ts:121",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Command Injection",
+      "location": "v3/@claude-flow/cli/__tests__/security-verification.test.ts:300",
+      "description": "Possible command injection"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/guidance/src/analyzer.ts:2709",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/guidance/src/hooks.ts:214",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/guidance/tests/analyzer.test.ts:74",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/guidance/tests/generators.test.ts:105",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/guidance/tests/generators.test.ts:107",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/memory/examples/cross-platform-usage.ts:32",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/memory/examples/cross-platform-usage.ts:33",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/memory/src/index.ts:219",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/memory/src/migration.ts:205",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/memory/src/rvf-migration.ts:203",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/memory/src/sqljs-backend.ts:115",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/memory/src/sqljs-backend.ts:124",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/memory/src/sqljs-backend.ts:777",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/neural/__tests__/patterns.test.ts:231",
+      "description": "eval() can execute arbitrary code"
+    }
+  ]
+}