claude-flow 3.25.6 → 3.26.0

package/.claude/security-scans/scan-code-deep.json

@@ -0,0 +1,1209 @@
+{
+  "timestamp": "2026-07-13T15:25:26.972Z",
+  "target": ".",
+  "depth": "deep",
+  "type": "code",
+  "summary": {
+    "critical": 0,
+    "high": 161,
+    "medium": 38,
+    "low": 0,
+    "total": 199
+  },
+  "findings": [
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "ruflo/docker-compose.public.yml:21",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/browser/tests/security-integration.test.ts:168",
+      "description": "API Key (Stripe/OpenAI)"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/browser/tests/workflow-templates.test.ts:100",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/cli/__tests__/plugins-transfer-deep.test.ts:1261",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/cli/__tests__/plugins-transfer-deep.test.ts:1271",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/cli/__tests__/security-audit.test.ts:204",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/codex/tests/validators.test.ts:126",
+      "description": "API Key (Stripe/OpenAI)"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/codex/tests/validators.test.ts:148",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/guidance/src/analyzer.ts:1725",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/guidance/src/analyzer.ts:2732",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/guidance/src/manifest-validator.ts:984",
+      "description": "API Key (Stripe/OpenAI)"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/guidance/tests/analyzer.test.ts:1205",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/guidance/tests/analyzer.test.ts:1292",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/guidance/tests/analyzer.test.ts:2021",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/guidance/tests/gates.test.ts:137",
+      "description": "API Key (Stripe/OpenAI)"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/guidance/tests/gates.test.ts:144",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/guidance/tests/gates.test.ts:155",
+      "description": "GitHub Token"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/guidance/tests/gates.test.ts:160",
+      "description": "AWS Access Key"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/guidance/tests/gates.test.ts:175",
+      "description": "API Key (Stripe/OpenAI)"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/guidance/tests/gateway.test.ts:512",
+      "description": "API Key (Stripe/OpenAI)"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/guidance/tests/hooks.test.ts:297",
+      "description": "API Key (Stripe/OpenAI)"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/guidance/tests/hooks.test.ts:419",
+      "description": "GitHub Token"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/guidance/tests/integration.test.ts:109",
+      "description": "API Key (Stripe/OpenAI)"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/guidance/tests/wasm-kernel.test.ts:152",
+      "description": "API Key (Stripe/OpenAI)"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/guidance/tests/wasm-kernel.test.ts:335",
+      "description": "API Key (Stripe/OpenAI)"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/plugin-agent-federation/__tests__/unit/pii-pipeline-service.test.ts:279",
+      "description": "API Key (Stripe/OpenAI)"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/plugin-agent-federation/__tests__/unit/pii-pipeline-service.test.ts:282",
+      "description": "API Key (Stripe/OpenAI)"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/plugins/__tests__/ruvector-bridge.test.ts:129",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/plugins/__tests__/utils/ruvector-test-utils.ts:188",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/ruvector-bridge.ts:1075",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/ruvector-bridge.ts:1988",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/security/__tests__/acceptance/security-compliance.test.ts:584",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/security/__tests__/helpers/create-mock.ts:174",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/security/__tests__/helpers/create-mock.ts:175",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/security/__tests__/input-validator.test.ts:193",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/security/__tests__/input-validator.test.ts:200",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/security/__tests__/input-validator.test.ts:208",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/security/__tests__/input-validator.test.ts:218",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/security/__tests__/input-validator.test.ts:355",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/security/__tests__/integration/security-flow.test.ts:325",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/security/__tests__/password-hasher.test.ts:128",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/security/__tests__/unit/password-hasher.test.ts:96",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/security/__tests__/unit/password-hasher.test.ts:110",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/security/__tests__/unit/password-hasher.test.ts:128",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/security/__tests__/unit/password-hasher.test.ts:165",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/security/__tests__/unit/password-hasher.test.ts:185",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/security/__tests__/unit/password-hasher.test.ts:197",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/security/__tests__/unit/password-hasher.test.ts:210",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/security/__tests__/unit/password-hasher.test.ts:236",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/security/__tests__/unit/password-hasher.test.ts:308",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/security/__tests__/unit/password-hasher.test.ts:318",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/security/__tests__/unit/password-hasher.test.ts:333",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/security/__tests__/unit/password-hasher.test.ts:349",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/security/src/credential-generator.ts:324",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/@claude-flow/security/src/credential-generator.ts:325",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/plugins/agentic-qe/src/tools/security-compliance/detect-secrets.ts:328",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/plugins/agentic-qe/src/tools/security-compliance/detect-secrets.ts:342",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/plugins/agentic-qe/src/tools/security-compliance/detect-secrets.ts:365",
+      "description": "Hardcoded Password"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Hardcoded Secret",
+      "location": "v3/plugins/code-intelligence/tests/types.test.ts:526",
+      "description": "AWS Access Key"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "ruflo/src/ruvocal/src/lib/server/database/postgres.ts:366",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "ruflo/src/ruvocal/src/lib/server/database/postgres.ts:404",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "ruflo/src/ruvocal/src/lib/server/database/postgres.ts:429",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "ruflo/src/ruvocal/src/lib/server/database/postgres.ts:446",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "ruflo/src/ruvocal/src/lib/server/database/postgres.ts:461",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "ruflo/src/ruvocal/src/lib/server/database/postgres.ts:472",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "ruflo/src/ruvocal/src/lib/server/database/postgres.ts:591",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "ruflo/src/ruvocal/src/lib/server/database/postgres.ts:594",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "ruflo/src/ruvocal/src/lib/server/database/postgres.ts:598",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Command Injection",
+      "location": "v3/@claude-flow/browser/src/mcp-tools/browser-tools.ts:633",
+      "description": "Possible command injection"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/browser/src/mcp-tools/browser-tools.ts:685",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/browser/tests/browser-service.test.ts:121",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Command Injection",
+      "location": "v3/@claude-flow/cli/__tests__/security-verification.test.ts:300",
+      "description": "Possible command injection"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/cli/src/benchmarks/pretrain/index.ts:239",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/cli/src/benchmarks/pretrain/index.ts:273",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/cli/src/benchmarks/pretrain/index.ts:498",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/cli/src/commands/analyze.ts:355",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "React XSS",
+      "location": "v3/@claude-flow/cli/src/commands/analyze.ts:358",
+      "description": "React XSS risk"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/cli/src/commands/embeddings.ts:1389",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/cli/src/commands/embeddings.ts:1391",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/cli/src/commands/embeddings.ts:1393",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/cli/src/commands/memory.ts:456",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/cli/src/commands/memory.ts:1706",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/cli/src/commands/neural.ts:1676",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/cli/src/commands/neural.ts:4408",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/cli/src/commands/ruvector/backup.ts:550",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/cli/src/commands/ruvector/backup.ts:679",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/cli/src/commands/ruvector/backup.ts:683",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/cli/src/commands/ruvector/import.ts:289",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/cli/src/commands/ruvector/import.ts:290",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/cli/src/commands/ruvector/import.ts:322",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/cli/src/commands/ruvector/import.ts:329",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/cli/src/commands/ruvector/import.ts:331",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/cli/src/commands/ruvector/import.ts:335",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/cli/src/commands/ruvector/import.ts:338",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/cli/src/commands/ruvector/import.ts:343",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/cli/src/commands/ruvector/import.ts:354",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Command Injection",
+      "location": "v3/@claude-flow/cli/src/commands/ruvector/import.ts:357",
+      "description": "Possible command injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/cli/src/commands/ruvector/import.ts:386",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/cli/src/commands/ruvector/import.ts:421",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/cli/src/commands/ruvector/optimize.ts:238",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/cli/src/commands/ruvector/optimize.ts:250",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/cli/src/commands/ruvector/optimize.ts:290",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/cli/src/commands/ruvector/optimize.ts:304",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/cli/src/commands/ruvector/optimize.ts:352",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/cli/src/commands/ruvector/optimize.ts:364",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/cli/src/commands/ruvector/optimize.ts:390",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/cli/src/commands/ruvector/optimize.ts:488",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/cli/src/commands/security.ts:145",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "React XSS",
+      "location": "v3/@claude-flow/cli/src/commands/security.ts:147",
+      "description": "React XSS risk"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Command Injection",
+      "location": "v3/@claude-flow/cli/src/commands/security.ts:148",
+      "description": "Possible command injection"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/cli/src/commands/security.ts:417",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Command Injection",
+      "location": "v3/@claude-flow/cli/src/commands/security.ts:420",
+      "description": "Possible command injection"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/cli/src/mcp-tools/hooks-tools.ts:3036",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/cli/src/mcp-tools/memory-tools.ts:531",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/cli/src/mcp-tools/neural-tools.ts:232",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/cli/src/memory/lucene-bm25.ts:13",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/cli/src/memory/memory-bridge.ts:1798",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/cli/src/services/distill-oracle.ts:19",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/cli/src/services/distill-tuning.ts:468",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/cli/src/services/weight-eft.ts:206",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "innerHTML",
+      "location": "v3/@claude-flow/cli-core/__tests__/coverage/lcov-report/prettify.js:2",
+      "description": "XSS risk with innerHTML"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "innerHTML",
+      "location": "v3/@claude-flow/cli-core/__tests__/coverage/lcov-report/sorter.js:84",
+      "description": "XSS risk with innerHTML"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "innerHTML",
+      "location": "v3/@claude-flow/cli-core/__tests__/coverage/prettify.js:2",
+      "description": "XSS risk with innerHTML"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "innerHTML",
+      "location": "v3/@claude-flow/cli-core/__tests__/coverage/sorter.js:84",
+      "description": "XSS risk with innerHTML"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/guidance/src/analyzer.ts:2709",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/guidance/src/hooks.ts:214",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/guidance/tests/analyzer.test.ts:74",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/guidance/tests/generators.test.ts:105",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/guidance/tests/generators.test.ts:107",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "React XSS",
+      "location": "v3/@claude-flow/hooks/src/workers/index.ts:1496",
+      "description": "React XSS risk"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/memory/examples/cross-platform-usage.ts:32",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/memory/examples/cross-platform-usage.ts:33",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/memory/src/index.ts:219",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/memory/src/migration.ts:205",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/memory/src/rvf-migration.ts:203",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/memory/src/sqljs-backend.ts:115",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/memory/src/sqljs-backend.ts:124",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/memory/src/sqljs-backend.ts:777",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/neural/__tests__/patterns.test.ts:231",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/examples/ruvector/attention-patterns.ts:97",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/examples/ruvector/basic-usage.ts:82",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/examples/ruvector/gnn-analysis.ts:217",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/examples/ruvector/hyperbolic-hierarchies.ts:243",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/examples/ruvector/quantization.ts:333",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/examples/ruvector/self-learning.ts:175",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/examples/ruvector/self-learning.ts:303",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/examples/ruvector/self-learning.ts:407",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/examples/ruvector/semantic-search.ts:357",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/examples/ruvector/streaming-large-data.ts:331",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/examples/ruvector/transactions.ts:241",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/attention-executor.ts:654",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/ruvector-bridge.ts:588",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/ruvector-bridge.ts:591",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/ruvector-bridge.ts:594",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/ruvector-bridge.ts:595",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/ruvector-bridge.ts:712",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/ruvector-bridge.ts:713",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/ruvector-bridge.ts:717",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/ruvector-bridge.ts:718",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/ruvector-bridge.ts:742",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/ruvector-bridge.ts:818",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/ruvector-bridge.ts:830",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/ruvector-bridge.ts:843",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/ruvector-bridge.ts:899",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/ruvector-bridge.ts:1128",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/self-learning.ts:705",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/streaming.ts:297",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/streaming.ts:362",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/streaming.ts:452",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/streaming.ts:455",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/streaming.ts:458",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/streaming.ts:463",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/streaming.ts:629",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/streaming.ts:630",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/streaming.ts:634",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/streaming.ts:635",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/streaming.ts:660",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/streaming.ts:868",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/streaming.ts:1051",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/streaming.ts:1052",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/streaming.ts:1056",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/streaming.ts:1057",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/streaming.ts:1124",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/streaming.ts:1147",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/streaming.ts:1249",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/streaming.ts:1252",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/streaming.ts:1255",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/streaming.ts:1256",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/plugins/src/integrations/ruvector/streaming.ts:1543",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/shared/src/events/event-store.ts:143",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/shared/src/events/event-store.ts:314",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/shared/src/events/event-store.ts:320",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "SQL Injection",
+      "location": "v3/@claude-flow/shared/src/events/event-store.ts:326",
+      "description": "Possible SQL injection"
+    },
+    {
+      "severity": "HIGH",
+      "type": "Command Injection",
+      "location": "v3/@claude-flow/testing/src/regression/security-regression.ts:77",
+      "description": "Possible command injection"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/testing/src/regression/security-regression.ts:128",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "Eval Usage",
+      "location": "v3/@claude-flow/testing/src/regression/security-regression.ts:129",
+      "description": "eval() can execute arbitrary code"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "React XSS",
+      "location": "v3/goal_ui/src/components/ui/chart.tsx:70",
+      "description": "React XSS risk"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "React XSS",
+      "location": "v3/plugins/agentic-qe/__tests__/tools/security-scan.test.ts:96",
+      "description": "React XSS risk"
+    },
+    {
+      "severity": "MEDIUM",
+      "type": "React XSS",
+      "location": "v3/plugins/agentic-qe/__tests__/tools/security-scan.test.ts:97",
+      "description": "React XSS risk"
+    }
+  ]
+}