fad-checker 1.0.2 → 1.0.4

package/data/cwe-names.json

@@ -0,0 +1,192 @@
+{
+  "_comment": "Common CWE identifiers → short human name. Covers the bulk of CVEs in practice. Source: cwe.mitre.org. Names are abbreviated for compact UI display.",
+  "CWE-20": "Improper Input Validation",
+  "CWE-22": "Path Traversal",
+  "CWE-59": "Link Following",
+  "CWE-74": "Improper Neutralization of Special Elements (Injection)",
+  "CWE-77": "Command Injection",
+  "CWE-78": "OS Command Injection",
+  "CWE-79": "Cross-site Scripting (XSS)",
+  "CWE-88": "Argument Injection",
+  "CWE-89": "SQL Injection",
+  "CWE-90": "LDAP Injection",
+  "CWE-91": "XML Injection",
+  "CWE-93": "CRLF Injection",
+  "CWE-94": "Code Injection",
+  "CWE-95": "Eval Injection",
+  "CWE-113": "HTTP Response Splitting",
+  "CWE-115": "Misinterpretation of Input",
+  "CWE-116": "Improper Encoding or Escaping of Output",
+  "CWE-117": "Improper Output Neutralization for Logs",
+  "CWE-118": "Incorrect Access of Indexable Resource",
+  "CWE-119": "Improper Restriction of Operations within the Bounds of a Memory Buffer",
+  "CWE-120": "Buffer Copy without Checking Size (Classic Buffer Overflow)",
+  "CWE-121": "Stack-based Buffer Overflow",
+  "CWE-122": "Heap-based Buffer Overflow",
+  "CWE-125": "Out-of-bounds Read",
+  "CWE-129": "Improper Validation of Array Index",
+  "CWE-131": "Incorrect Calculation of Buffer Size",
+  "CWE-134": "Use of Externally-Controlled Format String",
+  "CWE-178": "Improper Handling of Case Sensitivity",
+  "CWE-184": "Incomplete List of Disallowed Inputs",
+  "CWE-185": "Incorrect Regular Expression",
+  "CWE-190": "Integer Overflow or Wraparound",
+  "CWE-191": "Integer Underflow",
+  "CWE-193": "Off-by-one Error",
+  "CWE-200": "Exposure of Sensitive Information to an Unauthorized Actor",
+  "CWE-203": "Observable Discrepancy",
+  "CWE-204": "Observable Response Discrepancy",
+  "CWE-208": "Observable Timing Discrepancy",
+  "CWE-209": "Generation of Error Message Containing Sensitive Information",
+  "CWE-212": "Improper Removal of Sensitive Information Before Storage or Transfer",
+  "CWE-215": "Insertion of Sensitive Information Into Debugging Code",
+  "CWE-226": "Sensitive Information in Resource Not Removed Before Reuse",
+  "CWE-241": "Improper Handling of Unexpected Data Type",
+  "CWE-248": "Uncaught Exception",
+  "CWE-252": "Unchecked Return Value",
+  "CWE-256": "Plaintext Storage of a Password",
+  "CWE-257": "Storing Passwords in a Recoverable Format",
+  "CWE-259": "Use of Hard-coded Password",
+  "CWE-260": "Password in Configuration File",
+  "CWE-261": "Weak Encoding for Password",
+  "CWE-262": "Not Using Password Aging",
+  "CWE-269": "Improper Privilege Management",
+  "CWE-272": "Least Privilege Violation",
+  "CWE-273": "Improper Check for Dropped Privileges",
+  "CWE-275": "Permission Issues",
+  "CWE-276": "Incorrect Default Permissions",
+  "CWE-281": "Improper Preservation of Permissions",
+  "CWE-284": "Improper Access Control",
+  "CWE-285": "Improper Authorization",
+  "CWE-287": "Improper Authentication",
+  "CWE-288": "Authentication Bypass Using an Alternate Path or Channel",
+  "CWE-290": "Authentication Bypass by Spoofing",
+  "CWE-294": "Authentication Bypass by Capture-replay",
+  "CWE-295": "Improper Certificate Validation",
+  "CWE-296": "Improper Following of a Certificate's Chain of Trust",
+  "CWE-297": "Improper Validation of Certificate with Host Mismatch",
+  "CWE-298": "Improper Validation of Certificate Expiration",
+  "CWE-299": "Improper Check for Certificate Revocation",
+  "CWE-300": "Channel Accessible by Non-Endpoint (MITM)",
+  "CWE-303": "Incorrect Implementation of Authentication Algorithm",
+  "CWE-305": "Authentication Bypass by Primary Weakness",
+  "CWE-306": "Missing Authentication for Critical Function",
+  "CWE-307": "Improper Restriction of Excessive Authentication Attempts",
+  "CWE-311": "Missing Encryption of Sensitive Data",
+  "CWE-312": "Cleartext Storage of Sensitive Information",
+  "CWE-319": "Cleartext Transmission of Sensitive Information",
+  "CWE-320": "Key Management Errors",
+  "CWE-321": "Use of Hard-coded Cryptographic Key",
+  "CWE-326": "Inadequate Encryption Strength",
+  "CWE-327": "Use of a Broken or Risky Cryptographic Algorithm",
+  "CWE-328": "Use of Weak Hash",
+  "CWE-329": "Generation of Predictable IV with CBC Mode",
+  "CWE-330": "Use of Insufficiently Random Values",
+  "CWE-331": "Insufficient Entropy",
+  "CWE-335": "Incorrect Usage of Seeds in PRNG",
+  "CWE-338": "Use of Cryptographically Weak PRNG",
+  "CWE-345": "Insufficient Verification of Data Authenticity",
+  "CWE-346": "Origin Validation Error",
+  "CWE-347": "Improper Verification of Cryptographic Signature",
+  "CWE-352": "Cross-Site Request Forgery (CSRF)",
+  "CWE-354": "Improper Validation of Integrity Check Value",
+  "CWE-358": "Improperly Implemented Security Check for Standard",
+  "CWE-362": "Race Condition",
+  "CWE-367": "TOCTOU Race Condition",
+  "CWE-369": "Divide By Zero",
+  "CWE-377": "Insecure Temporary File",
+  "CWE-378": "Creation of Temporary File With Insecure Permissions",
+  "CWE-384": "Session Fixation",
+  "CWE-390": "Detection of Error Condition Without Action",
+  "CWE-400": "Uncontrolled Resource Consumption (DoS)",
+  "CWE-401": "Missing Release of Memory after Effective Lifetime",
+  "CWE-402": "Transmission of Private Resources into a New Sphere",
+  "CWE-404": "Improper Resource Shutdown or Release",
+  "CWE-405": "Asymmetric Resource Consumption (Amplification)",
+  "CWE-407": "Inefficient Algorithmic Complexity",
+  "CWE-409": "Improper Handling of Highly Compressed Data (Zip Bomb)",
+  "CWE-415": "Double Free",
+  "CWE-416": "Use After Free",
+  "CWE-419": "Unprotected Primary Channel",
+  "CWE-425": "Direct Request (Forced Browsing)",
+  "CWE-426": "Untrusted Search Path",
+  "CWE-427": "Uncontrolled Search Path Element",
+  "CWE-428": "Unquoted Search Path or Element",
+  "CWE-434": "Unrestricted Upload of File with Dangerous Type",
+  "CWE-436": "Interpretation Conflict",
+  "CWE-441": "Unintended Proxy or Intermediary (Confused Deputy)",
+  "CWE-444": "HTTP Request/Response Smuggling",
+  "CWE-451": "UI Misrepresentation of Critical Information",
+  "CWE-459": "Incomplete Cleanup",
+  "CWE-470": "Unsafe Reflection",
+  "CWE-471": "Modification of Assumed-Immutable Data",
+  "CWE-476": "NULL Pointer Dereference",
+  "CWE-477": "Use of Obsolete Function",
+  "CWE-489": "Active Debug Code",
+  "CWE-494": "Download of Code Without Integrity Check",
+  "CWE-497": "Exposure of Sensitive System Information to an Unauthorized Control Sphere",
+  "CWE-502": "Deserialization of Untrusted Data",
+  "CWE-521": "Weak Password Requirements",
+  "CWE-522": "Insufficiently Protected Credentials",
+  "CWE-523": "Unprotected Transport of Credentials",
+  "CWE-532": "Insertion of Sensitive Information into Log File",
+  "CWE-540": "Inclusion of Sensitive Information in Source Code",
+  "CWE-548": "Exposure of Information Through Directory Listing",
+  "CWE-552": "Files or Directories Accessible to External Parties",
+  "CWE-565": "Reliance on Cookies without Validation and Integrity Checking",
+  "CWE-601": "URL Redirection to Untrusted Site (Open Redirect)",
+  "CWE-610": "Externally Controlled Reference to a Resource in Another Sphere",
+  "CWE-611": "XML External Entity (XXE)",
+  "CWE-613": "Insufficient Session Expiration",
+  "CWE-617": "Reachable Assertion",
+  "CWE-639": "Authorization Bypass Through User-Controlled Key (IDOR)",
+  "CWE-640": "Weak Password Recovery Mechanism for Forgotten Password",
+  "CWE-641": "Improper Restriction of Names for Files and Other Resources",
+  "CWE-643": "XPath Injection",
+  "CWE-645": "Overly Restrictive Account Lockout Mechanism",
+  "CWE-652": "XQuery Injection",
+  "CWE-665": "Improper Initialization",
+  "CWE-668": "Exposure of Resource to Wrong Sphere",
+  "CWE-670": "Always-Incorrect Control Flow Implementation",
+  "CWE-672": "Operation on a Resource after Expiration or Release",
+  "CWE-674": "Uncontrolled Recursion",
+  "CWE-682": "Incorrect Calculation",
+  "CWE-693": "Protection Mechanism Failure",
+  "CWE-697": "Incorrect Comparison",
+  "CWE-704": "Incorrect Type Conversion or Cast",
+  "CWE-732": "Incorrect Permission Assignment for Critical Resource",
+  "CWE-749": "Exposed Dangerous Method or Function",
+  "CWE-754": "Improper Check for Unusual or Exceptional Conditions",
+  "CWE-755": "Improper Handling of Exceptional Conditions",
+  "CWE-763": "Release of Invalid Pointer or Reference",
+  "CWE-770": "Allocation of Resources Without Limits or Throttling",
+  "CWE-772": "Missing Release of Resource after Effective Lifetime",
+  "CWE-776": "XML Entity Expansion (XEE / Billion Laughs)",
+  "CWE-787": "Out-of-bounds Write",
+  "CWE-789": "Memory Allocation with Excessive Size Value",
+  "CWE-798": "Use of Hard-coded Credentials",
+  "CWE-829": "Inclusion of Functionality from Untrusted Control Sphere",
+  "CWE-834": "Excessive Iteration",
+  "CWE-835": "Loop with Unreachable Exit Condition (Infinite Loop)",
+  "CWE-838": "Inappropriate Encoding for Output Context",
+  "CWE-843": "Type Confusion (Access of Resource Using Incompatible Type)",
+  "CWE-862": "Missing Authorization",
+  "CWE-863": "Incorrect Authorization",
+  "CWE-908": "Use of Uninitialized Resource",
+  "CWE-913": "Improper Control of Dynamically-Managed Code Resources",
+  "CWE-915": "Mass Assignment",
+  "CWE-916": "Use of Password Hash With Insufficient Computational Effort",
+  "CWE-917": "Expression Language Injection (EL Injection)",
+  "CWE-918": "Server-Side Request Forgery (SSRF)",
+  "CWE-920": "Improper Restriction of Power Consumption",
+  "CWE-921": "Storage of Sensitive Data in a Mechanism without Access Control",
+  "CWE-924": "Improper Enforcement of Message Integrity During Transmission in a Communication Channel",
+  "CWE-1004": "Sensitive Cookie Without 'HttpOnly' Flag",
+  "CWE-1021": "Improper Restriction of Rendered UI Layers (Clickjacking)",
+  "CWE-1188": "Insecure Default Initialization of Resource",
+  "CWE-1236": "CSV Formula Injection",
+  "CWE-1275": "Sensitive Cookie with Improper SameSite Attribute",
+  "CWE-1284": "Improper Validation of Specified Quantity in Input",
+  "CWE-1321": "Improperly Controlled Modification of Object Prototype (Prototype Pollution)",
+  "CWE-1333": "Inefficient Regular Expression Complexity (ReDoS)"
+}

package/fad-checker.js

@@ -540,27 +540,30 @@ async function runReportFlow(allPomMetadata, allPropsByPom, ecoFlags = {}) {
 	}
 
 	// Split prod vs dev based on the dep's isDev flag (set at collection time
-	// from Maven scope=test/provided and npm dev/devOptional/optional).
-	// CPE-filtered matches are excluded from the CLI headline — they're surfaced
-	// in the HTML report's "Likely false positives" appendix instead.
-	const prodMatches = cveMatches.filter(m => !m.dep?.isDev && !m.cpeFiltered);
-	const devMatches  = cveMatches.filter(m =>  m.dep?.isDev && !m.cpeFiltered);
-	const cpeFilteredCount = cveMatches.filter(m => m.cpeFiltered).length;
-
-	const stats = computeStats(prodMatches);
-	const devStats = computeStats(devMatches);
-	console.log(chalk.bold.cyan(`\n  1. CVE Vulnerabilities (production: ${prodMatches.length})`));
+	// from Maven scope=test/provided and npm dev/devOptional/optional). Keep the
+	// full per-bucket list (including cpeFiltered) so the HTML report can render
+	// its "Likely false positives" appendix — only the CLI headline excludes
+	// cpeFiltered to avoid alarming on triaged-out matches.
+	const prodMatches = cveMatches.filter(m => !m.dep?.isDev);
+	const devMatches  = cveMatches.filter(m =>  m.dep?.isDev);
+	const prodActive  = prodMatches.filter(m => !m.cpeFiltered);
+	const devActive   = devMatches.filter(m => !m.cpeFiltered);
+	const cpeFilteredCount = (prodMatches.length - prodActive.length) + (devMatches.length - devActive.length);
+
+	const stats = computeStats(prodActive);
+	const devStats = computeStats(devActive);
+	console.log(chalk.bold.cyan(`\n  1. CVE Vulnerabilities (production: ${prodActive.length})`));
 	console.log(`     critical=${stats.critical}  high=${stats.high}  medium=${stats.medium}  low=${stats.low}  unknown=${stats.unknown}`);
 	const depLabel = d => d.ecosystem === "npm" ? `npm:${d.artifactId}` : `${d.groupId}:${d.artifactId}`;
-	for (const m of prodMatches.slice(0, 20)) {
+	for (const m of prodActive.slice(0, 20)) {
 		const sev = (m.cve.severity || "UNKNOWN").padEnd(8);
 		console.log(`       ${chalk.red(sev)} ${m.cve.id}  ${depLabel(m.dep)}:${m.dep.version}`);
 	}
-	if (prodMatches.length > 20) console.log(`       ... and ${prodMatches.length - 20} more (see report)`);
+	if (prodActive.length > 20) console.log(`       ... and ${prodActive.length - 20} more (see report)`);
 	if (cpeFilteredCount) console.log(chalk.gray(`     (${cpeFilteredCount} likely false positives moved to report appendix)`));
 
-	if (devMatches.length) {
-		console.log(chalk.bold.cyan(`\n  2. CVE in dev dependencies (${devMatches.length})`));
+	if (devActive.length) {
+		console.log(chalk.bold.cyan(`\n  2. CVE in dev dependencies (${devActive.length})`));
 		console.log(`     critical=${devStats.critical}  high=${devStats.high}  medium=${devStats.medium}  low=${devStats.low}  unknown=${devStats.unknown}`);
 	}
 	if (retireMatches.length) {

package/lib/cve-match.js

@@ -166,11 +166,15 @@ function vendorMatchesGroup(vendor, groupId) {
 	const v = vendor.toLowerCase();
 	const g = groupId.toLowerCase();
 	if (g === v) return true;
-	// org.apache.commons matches vendor "apache" via dot-segment membership.
-	// Unbounded substring checks (g.includes(v) / v.includes(g)) used to leak
-	// FPs — e.g. vendor "open" matching org.opensaml.* because "opensaml"
-	// contains "open". Dot-segment membership is strict enough.
-	if (g.split(".").includes(v)) return true;
+	const segments = g.split(".");
+	// Plain dot-segment match (vendor "apache" ⊂ "org.apache.commons").
+	if (segments.includes(v)) return true;
+	// NVD/CVEProject often record vendor as a legal entity ("qos.ch sarl",
+	// "the apache software foundation"). Split on non-alphanumerics and accept
+	// the match if any token is a dot-segment of the groupId. Unbounded
+	// substring matching is still avoided.
+	const vendorTokens = v.split(/[^a-z0-9]+/).filter(Boolean);
+	if (vendorTokens.length > 1 && vendorTokens.some(t => segments.includes(t))) return true;
 	return false;
 }
 

package/lib/cve-report.js

@@ -8,6 +8,21 @@
 const fs = require("fs");
 const path = require("path");
 
+// CWE-id → short human name. Loaded once at module init. Unknown CWEs fall
+// back to the raw id (with a "—" placeholder name where the row asks for one).
+const CWE_NAMES = (() => {
+	try {
+		const raw = JSON.parse(fs.readFileSync(path.join(__dirname, "..", "data", "cwe-names.json"), "utf8"));
+		delete raw._comment;
+		return raw;
+	} catch { return {}; }
+})();
+function cweName(id) {
+	if (!id) return "";
+	const key = String(id).toUpperCase();
+	return CWE_NAMES[key] || "";
+}
+
 function esc(s) {
 	if (s == null) return "";
 	return String(s)
@@ -84,6 +99,17 @@ td.cwe .cwe-link { color: #6366f1; text-decoration: none; }
 td.cwe .cwe-link:hover { text-decoration: underline; }
 td.cwe .cwe-empty { color: #d1d5db; }
 td.cwe .cwe-more { color: #9ca3af; font-style: italic; font-size: 10px; }
+td.cwe .cwe-name { font-family: -apple-system, "Segoe UI", Roboto, sans-serif; font-size: 10px; color: #6b7280; line-height: 1.3; margin-top: 1px; max-width: 220px; }
+.cwe-list { list-style: none; padding: 0; margin: 0; }
+.cwe-list li { padding: 3px 0; font-size: 12px; line-height: 1.5; }
+.cwe-list li .cwe-link { font-family: ui-monospace, monospace; color: #4338ca; text-decoration: none; font-weight: 600; }
+.cwe-list li .cwe-link:hover { text-decoration: underline; }
+.cwe-list li .cwe-name-inline { color: #374151; }
+.cwe-list li .cwe-empty { color: #9ca3af; font-style: italic; }
+/* CWE chip in the exec summary */
+.exec-summary .exec-cwe { display: inline-flex; align-items: baseline; gap: 4px; font-size: 11px; color: #4b5563; background: #eef2ff; border: 1px solid #c7d2fe; padding: 1px 6px; border-radius: 3px; margin-left: 2px; }
+.exec-summary .exec-cwe .exec-cwe-id { font-family: ui-monospace, monospace; font-weight: 600; color: #4338ca; }
+.exec-summary .exec-cwe .exec-cwe-name { color: #4b5563; }
 td.published { font-family: ui-monospace, monospace; font-size: 11px; color: #6b7280; white-space: nowrap; }
 tr.cve-row.cpe-fp td { opacity: .55; }
 .jump-badge { display: inline-block; padding: 1px 8px; border-radius: 4px; font-size: 10px; font-weight: 700; text-transform: uppercase; letter-spacing: .5px; }
@@ -196,6 +222,14 @@ details.report-subsection details.report-subsection details.report-subsection >
 .toolbar .btn.primary { background: #4f46e5; color: #fff; border-color: #4f46e5; }
 .toolbar .btn.primary:hover { background: #4338ca; }
 .toolbar .toolbar-label { font-size: 11px; color: #6b7280; }
+/* Table copy controls — one toolbar per table */
+.table-wrap { margin: 8px 0 24px; }
+.table-wrap > table { margin: 0; }
+.table-actions { display: flex; justify-content: flex-end; gap: 6px; margin-bottom: 4px; }
+.btn-copy { display: inline-flex; align-items: center; gap: 4px; padding: 3px 10px; font-size: 11px; background: #fff; border: 1px solid #d1d5db; border-radius: 4px; cursor: pointer; color: #4b5563; font-family: inherit; transition: all .15s ease; }
+.btn-copy:hover { background: #eef2ff; border-color: #6366f1; color: #4338ca; }
+.btn-copy.flashing-ok { background: #10b981; color: #fff; border-color: #10b981; }
+.btn-copy.flashing-err { background: #dc2626; color: #fff; border-color: #dc2626; }
 .fix-recipe { background: #fff7ed; border: 1px solid #fed7aa; border-left: 4px solid #f97316; padding: 10px 14px; border-radius: 4px; margin: 6px 0; font-size: 12px; }
 .fix-recipe code { display: block; background: #1f2937; color: #f3f4f6; padding: 8px 10px; border-radius: 3px; font-size: 11px; margin-top: 6px; white-space: pre; overflow-x: auto; }
 .fix-recipe .recipe-title { font-weight: 600; margin-bottom: 2px; }
@@ -424,7 +458,12 @@ function renderDetailPanel(m) {
 		sections.push(section("Description", `<div class="full-desc">${esc(cve.description)}</div>`));
 	}
 
-	// 2. Metadata
+	// 2. Weaknesses (CWE) — id + human name, links to mitre.org
+	if (Array.isArray(cve.cwes) && cve.cwes.length) {
+		sections.push(section("Weaknesses (CWE)", formatCwesVerbose(cve.cwes), { count: cve.cwes.length }));
+	}
+
+	// 3. Metadata
 	const kv = [];
 	if (cve.cvssVector) kv.push(`<div><label>${esc(cve.cvssVersion || "CVSS")}</label><span class="cvss-vector">${esc(cve.cvssVector)}</span></div>`);
 	if (cve.score != null) kv.push(`<div><label>Base score</label><span>${esc(cve.score.toFixed ? cve.score.toFixed(1) : cve.score)} (${esc(cve.severity || "?")})</span></div>`);
@@ -502,7 +541,29 @@ function formatCwes(cwes) {
 	if (!Array.isArray(cwes) || !cwes.length) return `<span class="cwe-empty">—</span>`;
 	const top = cwes.slice(0, 2);
 	const more = cwes.length > 2 ? ` <span class="cwe-more">+${cwes.length - 2}</span>` : "";
-	return top.map(c => `<a href="https://cwe.mitre.org/data/definitions/${esc(String(c).replace(/^CWE-/i, ""))}.html" target="_blank" rel="noopener" class="cwe-link">${esc(c)}</a>`).join(" ") + more;
+	return top.map(c => {
+		const id = String(c);
+		const name = cweName(id);
+		const num = id.replace(/^CWE-/i, "");
+		const link = `<a href="https://cwe.mitre.org/data/definitions/${esc(num)}.html" target="_blank" rel="noopener" class="cwe-link"${name ? ` title="${esc(id)}: ${esc(name)}"` : ""}>${esc(id)}</a>`;
+		// Show the human name inline beneath the id (compact, italic) when we know it
+		return name ? `${link}<div class="cwe-name">${esc(name)}</div>` : link;
+	}).join(" ") + more;
+}
+
+// Verbose CWE list for the detail panel: id link + full human name on the
+// same line, no truncation. Used in renderDetailPanel.
+function formatCwesVerbose(cwes) {
+	if (!Array.isArray(cwes) || !cwes.length) return "";
+	return `<ul class="cwe-list">${cwes.map(c => {
+		const id = String(c);
+		const name = cweName(id);
+		const num = id.replace(/^CWE-/i, "");
+		return `<li>
+			<a href="https://cwe.mitre.org/data/definitions/${esc(num)}.html" target="_blank" rel="noopener" class="cwe-link">${esc(id)}</a>
+			${name ? `<span class="cwe-name-inline">— ${esc(name)}</span>` : `<span class="cwe-empty">(unknown weakness)</span>`}
+		</li>`;
+	}).join("")}</ul>`;
 }
 
 function renderCveRow(m, opts = {}) {
@@ -1125,13 +1186,22 @@ function renderExecutiveSummary({ projectInfo, prodStats, devStats, retireStats,
 
 	const topPreview = (topCriticalMatches || []).length ? `<div class="exec-top">
 		<div class="exec-top-title">Top ${topCriticalMatches.length} most critical (preview)</div>
-		<ul class="exec-top-list">${topCriticalMatches.map(m => `<li>
-			${badge((m.cve.severity || "HIGH").toUpperCase())}
-			<a class="exec-cve-link" href="#ch${m.dep?.scope === "vendored" ? "2" : "1"}">${esc(m.cve.id)}</a>
-			<code>${esc(depDisplayName(m.dep))}</code>
-			<span class="exec-ver">${esc(m.dep.version || "?")}</span>
-			${m.cve.fixVersion ? `<span class="exec-fix">→ ${esc(m.cve.fixVersion)}</span>` : ""}
-		</li>`).join("")}</ul>
+		<ul class="exec-top-list">${topCriticalMatches.map(m => {
+			// First known-CWE on the match gets surfaced in the summary so the
+			// reader has a one-line answer to "what kind of weakness is this?"
+			const cwes = Array.isArray(m.cve.cwes) ? m.cve.cwes : [];
+			const primary = cwes.find(c => cweName(c)) || cwes[0];
+			const primaryName = primary ? cweName(primary) : "";
+			const cweChip = primary ? `<span class="exec-cwe" title="${esc(primary)}${primaryName ? ": " + esc(primaryName) : ""}"><span class="exec-cwe-id">${esc(primary)}</span>${primaryName ? `<span class="exec-cwe-name">${esc(primaryName)}</span>` : ""}</span>` : "";
+			return `<li>
+				${badge((m.cve.severity || "HIGH").toUpperCase())}
+				<a class="exec-cve-link" href="#ch${m.dep?.scope === "vendored" ? "2" : "1"}">${esc(m.cve.id)}</a>
+				<code>${esc(depDisplayName(m.dep))}</code>
+				<span class="exec-ver">${esc(m.dep.version || "?")}</span>
+				${m.cve.fixVersion ? `<span class="exec-fix">→ ${esc(m.cve.fixVersion)}</span>` : ""}
+				${cweChip}
+			</li>`;
+		}).join("")}</ul>
 	</div>` : "";
 
 	return `<div class="exec-summary exec-${esc(level.toLowerCase())}">
@@ -1186,7 +1256,7 @@ function renderWarningItems(items, itemLimit) {
 	return `<ul class="warn-items">${lis}${overflow}</ul>`;
 }
 
-function buildBody({ cveMatches, devCveMatches, retireMatches, eolResults, obsoleteResults, outdatedResults, resolvedDeps, projectInfo, warnings }) {
+function buildBody({ cveMatches, devCveMatches, retireMatches, eolResults, obsoleteResults, outdatedResults, resolvedDeps, projectInfo, warnings, wrapTables = true }) {
 	setRenderCtx({ srcRoot: projectInfo?.src || null });
 	// Dedupe rows so a single (dep, cve) shows once with all via paths merged.
 	cveMatches    = mergeMatches(cveMatches || []);
@@ -1244,7 +1314,7 @@ function buildBody({ cveMatches, devCveMatches, retireMatches, eolResults, obsol
 		fpTotal: prodMatchesFP.length + devMatchesFP.length,
 	});
 
-	return `
+	const body = `
 		<header class="report-header">
 			<h1>FAD-Checker Report</h1>
 			<div class="report-subtitle">Multi-ecosystem dependency security audit</div>
@@ -1268,6 +1338,7 @@ function buildBody({ cveMatches, devCveMatches, retireMatches, eolResults, obsol
 		${majorSection(`7. Fix Recommendations`, renderFixRecommendations(recos, prodMatchesActive, outdatedResults), { open: false, id: "ch7" })}
 		${(prodMatchesFP.length + devMatchesFP.length) ? majorSection(`8. Appendix: Likely false positives (CPE-filtered) (${prodMatchesFP.length + devMatchesFP.length})`, fpContent, { open: false, id: "ch8" }) : ""}
 	`;
+	return wrapTables ? wrapTablesWithCopyButtons(body) : body;
 }
 
 /**
@@ -1346,6 +1417,127 @@ function renderCveBySectionByEco(matches, chapterPrefix, srcRoot) {
 	return out.join("") || `<div class="empty">No CVE matches.</div>`;
 }
 
+/**
+ * Wrap every <table>…</table> in the body HTML with a `.table-wrap` div that
+ * carries a small toolbar with a "Copy table" button. The button is wired up
+ * by COPY_SCRIPT below — it copies the table as styled HTML (Word-compatible)
+ * with a TSV fallback for text-only paste targets.
+ *
+ * Skipped for the Word output (wrapTables=false in buildBody) since Word can't
+ * run JS and the bare table is what we want there.
+ */
+function wrapTablesWithCopyButtons(html) {
+	return html.replace(/(<table\b[^>]*>[\s\S]*?<\/table>)/g, (match) => {
+		return `<div class="table-wrap"><div class="table-actions"><button class="btn-copy" type="button" title="Copy this table — paste it into Word with formatting preserved">📋 Copy table</button></div>${match}</div>`;
+	});
+}
+
+const COPY_SCRIPT = `
+<script>
+(function(){
+	// Inline styles applied to clipboard-bound table so it survives pasting into
+	// Word with reasonable formatting (Word ignores most external CSS classes,
+	// but honours inline style="…" attributes).
+	function inlineStylesForWord(table){
+		var clone = table.cloneNode(true);
+		// Drop expandable detail rows (they would paste as huge empty cells)
+		clone.querySelectorAll('tr.detail-row').forEach(function(r){ r.remove(); });
+		// Strip our interactive classes so Word doesn't try to interpret them
+		clone.querySelectorAll('tr.cve-row').forEach(function(r){
+			r.classList.remove('cve-row');
+			r.classList.remove('open');
+			r.classList.remove('cpe-fp');
+		});
+		clone.setAttribute('border', '1');
+		clone.setAttribute('cellspacing', '0');
+		clone.setAttribute('cellpadding', '6');
+		clone.setAttribute('width', '100%');
+		clone.setAttribute('style', 'width:100%; border-collapse:collapse; font-family:Calibri,Arial,sans-serif; font-size:10pt; color:#1f2937;');
+		clone.querySelectorAll('th').forEach(function(th){
+			th.setAttribute('style', 'background:#f3f4f6; padding:6px 8px; border:1px solid #d1d5db; text-align:left; font-weight:bold; font-size:9pt; text-transform:uppercase; letter-spacing:.5px; color:#4b5563;');
+		});
+		clone.querySelectorAll('td').forEach(function(td){
+			var prev = td.getAttribute('style') || '';
+			td.setAttribute('style', 'padding:6px 8px; border:1px solid #e5e7eb; vertical-align:top; ' + prev);
+		});
+		// Replace severity badges with plain coloured text so they survive paste
+		clone.querySelectorAll('span[style*="border-radius"]').forEach(function(s){
+			var m = (s.getAttribute('style') || '').match(/background:\\s*(#[0-9a-fA-F]{3,6})/);
+			var bg = m ? m[1] : '#666';
+			s.setAttribute('style', 'background:' + bg + '; color:#fff; padding:2px 6px; font-weight:bold; font-size:9pt;');
+		});
+		return clone;
+	}
+	function wordWrapper(tableHtml){
+		return '<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40"><head><meta charset="utf-8"></head><body>' + tableHtml + '</body></html>';
+	}
+	function tableToTsv(table){
+		var rows = Array.prototype.filter.call(table.querySelectorAll('tr'), function(r){ return !r.classList.contains('detail-row'); });
+		return rows.map(function(r){
+			return Array.prototype.map.call(r.querySelectorAll('th, td'), function(c){
+				return (c.innerText || c.textContent || '').replace(/[\\t\\r\\n]+/g, ' ').trim();
+			}).join('\\t');
+		}).join('\\n');
+	}
+	function flash(btn, cls, msg){
+		var old = btn.textContent;
+		btn.textContent = msg;
+		btn.classList.add(cls);
+		setTimeout(function(){
+			btn.textContent = old;
+			btn.classList.remove(cls);
+		}, 1500);
+	}
+	async function copyTable(table, btn){
+		var clone = inlineStylesForWord(table);
+		var html = wordWrapper(clone.outerHTML);
+		var tsv = tableToTsv(table);
+		// Modern path: ClipboardItem with text/html + text/plain
+		try {
+			if (window.ClipboardItem && navigator.clipboard && navigator.clipboard.write) {
+				await navigator.clipboard.write([
+					new ClipboardItem({
+						'text/html':  new Blob([html], { type: 'text/html'  }),
+						'text/plain': new Blob([tsv],  { type: 'text/plain' })
+					})
+				]);
+				flash(btn, 'flashing-ok', '✓ Copied!');
+				return;
+			}
+		} catch(e) { /* fall through to legacy path */ }
+		// Legacy path: select clone, execCommand('copy') — gets the HTML
+		try {
+			var temp = document.createElement('div');
+			temp.setAttribute('contenteditable', 'true');
+			temp.style.position = 'fixed';
+			temp.style.left = '-9999px';
+			temp.style.top = '0';
+			temp.innerHTML = clone.outerHTML;
+			document.body.appendChild(temp);
+			var range = document.createRange();
+			range.selectNodeContents(temp);
+			var sel = window.getSelection();
+			sel.removeAllRanges();
+			sel.addRange(range);
+			var ok = document.execCommand('copy');
+			sel.removeAllRanges();
+			document.body.removeChild(temp);
+			flash(btn, ok ? 'flashing-ok' : 'flashing-err', ok ? '✓ Copied!' : '✗ Copy failed');
+		} catch(e) {
+			flash(btn, 'flashing-err', '✗ Copy failed');
+		}
+	}
+	document.querySelectorAll('.btn-copy').forEach(function(btn){
+		btn.addEventListener('click', function(e){
+			e.stopPropagation();
+			var wrap = btn.closest('.table-wrap');
+			var table = wrap && wrap.querySelector('table');
+			if (table) copyTable(table, btn);
+		});
+	});
+})();
+</script>`;
+
 const TOGGLE_SCRIPT = `
 <script>
 (function(){
@@ -1402,13 +1594,128 @@ const TOGGLE_SCRIPT = `
 function generateHtmlReport(payload) {
 	return `<!doctype html>
 <html><head><meta charset="utf-8"><title>FAD-Checker Report</title><style>${CSS}</style></head>
-<body>${buildBody(payload)}${TOGGLE_SCRIPT}</body></html>`;
+<body>${buildBody(payload)}${TOGGLE_SCRIPT}${COPY_SCRIPT}</body></html>`;
+}
+
+// Word-specific CSS tweaks layered on top of the shared CSS:
+//   - landscape A4 with tight margins to maximise usable column width
+//   - thead repeats on every page break, rows stay together
+//   - sticky/transitions/box-shadow stripped (Word renders them oddly)
+//   - chevron pseudo-elements hidden (Word can't toggle them anyway)
+//   - tables get an explicit 100% width attribute so Word fits-to-page
+//   - smaller font / padding inside tables to cram more columns into the page
+//
+// Dimensions are given in cm (A4 landscape = 29.7×21cm). The `mso-page-orientation`
+// property is the actually-honoured-by-Word landscape switch; without it Word
+// often defaults to portrait even when @page asks for landscape.
+const WORD_CSS = `
+@page WordSection1 {
+	size: 29.7cm 21cm;
+	mso-page-orientation: landscape;
+	margin: 1cm 1cm 1cm 1cm;
+	mso-header-margin: .5cm;
+	mso-footer-margin: .5cm;
+	mso-paper-source: 0;
+}
+div.WordSection1 { page: WordSection1; }
+body { margin: 0; background: #fff; }
+/* Tables: hard-fit to page width. table-layout:fixed forces Word to honour
+   width:100% even when content would naturally be wider. */
+table { mso-table-lspace: 0; mso-table-rspace: 0; width: 100% !important; max-width: 100% !important; table-layout: fixed; font-size: 9pt; }
+th, td { padding: 4px 6px !important; font-size: 9pt; word-break: break-word; overflow-wrap: anywhere; }
+th { font-size: 8pt; }
+tr { page-break-inside: avoid; }
+thead { display: table-header-group; }
+h1, h2, h3, summary { page-break-after: avoid; }
+details.report-section, details.report-subsection { page-break-inside: auto; }
+/* Strip interactive affordances Word can't honour */
+.toolbar, .toc { display: none !important; }
+details > summary { cursor: default; list-style: none; }
+details.report-section > summary h2::before,
+details.report-subsection > summary h3::before { content: "" !important; display: none !important; }
+tr.cve-row td:first-child::before { content: "" !important; display: none !important; }
+tr.cve-row, tr.cve-row.open { background: #fff !important; cursor: default; }
+/* Detail rows always shown (no JS toggling in Word) */
+tr.detail-row { display: table-row !important; }
+/* Remove shadows / sticky / hover effects that confuse Word */
+.report-header, .exec-summary, .summary .card, .warnings { box-shadow: none !important; }
+.fix-recipe code { white-space: pre-wrap; word-break: break-word; overflow-x: visible; font-size: 8pt; }
+/* Long URLs and coordinates: wrap instead of overflow */
+td.cve, td.dep, .via, .ref-list li, .defined-in code { word-break: break-word; overflow-wrap: anywhere; }
+/* Tighter colour palette so Word prints cleanly */
+tr:nth-child(even) { background: #fafafa; }
+/* Detail panel: shrink so expanded CVE blocks don't dominate the page */
+.detail-panel { padding: 8px 12px; font-size: 9pt; }
+.detail-panel .full-desc { font-size: 9pt; line-height: 1.4; }
+`;
+
+// Section properties Word reads from a conditional comment. This is the
+// actually-reliable way to force landscape — @page rules in <style> are
+// inconsistently honoured across Word versions, but `<w:sectPr>` is.
+// Page size in twips: A4 landscape = 16838 × 11906 (1cm ≈ 567 twips).
+const WORD_SECTION_PR = `<!--[if gte mso 9]>
+<xml>
+<w:WordDocument>
+<w:View>Print</w:View>
+<w:Zoom>100</w:Zoom>
+<w:DoNotOptimizeForBrowser/>
+</w:WordDocument>
+</xml>
+<![endif]-->
+<!--[if gte mso 9]>
+<style>
+@page WordSection1 {
+	size: 16838twips 11906twips;
+	mso-page-orientation: landscape;
+	margin: 567twips 567twips 567twips 567twips;
+}
+</style>
+<![endif]-->`;
+
+// Column widths (in %) per known table shape. table-layout:fixed needs these
+// so Word can lay out the columns deterministically instead of inflating wide
+// columns based on natural content width.
+const TABLE_COLGROUPS = {
+	// 8-col CVE table (header starts with <th>Severity</th><th>CVE ID</th>…)
+	cve: { match: /<thead><tr><th>Severity<\/th><th>CVE ID<\/th><th>Dependency<\/th><th>CWE<\/th><th>Published<\/th><th>Description<\/th><th>Fix Version<\/th><th>Source<\/th>(<th>Recommended action<\/th>)?<\/tr><\/thead>/,
+	  widths8: [7, 10, 15, 10, 7, 26, 11, 14],
+	  widths9: [6, 9, 13, 9, 6, 22, 10, 13, 12] },
+	// 5-col EOL table
+	eol: { match: /<thead><tr><th>Product<\/th><th>Dependency<\/th><th>EOL date<\/th><th>Latest<\/th><th>Notes<\/th><\/tr><\/thead>/,
+	  widths: [15, 25, 12, 12, 36] },
+	// 4-col Obsolete table
+	obsolete: { match: /<thead><tr><th>Severity<\/th><th>Obsolete<\/th><th>Replacement<\/th><th>Why<\/th><\/tr><\/thead>/,
+	  widths: [10, 25, 25, 40] },
+	// 5-col Outdated table
+	outdated: { match: /<thead><tr><th>Jump<\/th><th>Dependency<\/th><th>Current<\/th><th>Latest<\/th><th>Released<\/th><\/tr><\/thead>/,
+	  widths: [12, 38, 18, 18, 14] },
+	// 6-col Retire.js table
+	retire: { match: /<thead><tr><th>Sev<\/th><th>Library<\/th><th>Vendored file<\/th><th>CVE \/ GHSA<\/th><th>Fixed in<\/th><th>Summary<\/th><\/tr><\/thead>/,
+	  widths: [8, 18, 24, 14, 12, 24] },
+};
+
+function colgroupHtml(widths) {
+	return `<colgroup>${widths.map(w => `<col style="width:${w}%">`).join("")}</colgroup>`;
+}
+
+// Inject a <colgroup> right after each table opening tag so Word respects the
+// width split. Detects which schema the table follows by its <thead>.
+function injectColgroups(html) {
+	// CVE 8-col / 9-col (action variant)
+	html = html.replace(new RegExp(`(<table[^>]*>)\\s*(${TABLE_COLGROUPS.cve.match.source})`, "g"), (m, tableTag, thead) => {
+		const widths = thead.includes("Recommended action") ? TABLE_COLGROUPS.cve.widths9 : TABLE_COLGROUPS.cve.widths8;
+		return `${tableTag}${colgroupHtml(widths)}${thead}`;
+	});
+	for (const key of ["eol", "obsolete", "outdated", "retire"]) {
+		const def = TABLE_COLGROUPS[key];
+		html = html.replace(new RegExp(`(<table[^>]*>)\\s*(${def.match.source})`, "g"),
+			(m, tableTag, thead) => `${tableTag}${colgroupHtml(def.widths)}${thead}`);
+	}
+	return html;
 }
 
-// Word can't run scripts and doesn't honour display:none reliably enough — so
-// the .doc variant ships with every section/detail/row already expanded.
 function generateWordReport(payload) {
-	let body = buildBody(payload);
+	let body = buildBody({ ...payload, wrapTables: false });
 	// Force-open every <details> and every cve-row/detail-row in the static markup
 	body = body.replace(/<details ([^>]*?)>/g, (m, attrs) => {
 		if (attrs.includes(" open")) return m;
@@ -1418,6 +1725,10 @@ function generateWordReport(payload) {
 	body = body.replace(/<tr class="cve-row">/g, '<tr class="cve-row open">');
 	// Drop the interactive toolbar (no buttons useful in a print/Word view)
 	body = body.replace(/<div class="toolbar">[\s\S]*?<\/div>/, "");
+	// Annotate every <table> with explicit width="100%" so Word resizes to page width
+	body = body.replace(/<table>/g, '<table border="1" cellspacing="0" cellpadding="4" width="100%" style="width:100%;border-collapse:collapse;table-layout:fixed">');
+	// Insert <colgroup> with %-widths so Word can split fixed-layout columns
+	body = injectColgroups(body);
 	return `<html xmlns:o="urn:schemas-microsoft-com:office:office"
         xmlns:w="urn:schemas-microsoft-com:office:word"
         xmlns="http://www.w3.org/TR/REC-html40">
@@ -1427,12 +1738,10 @@ function generateWordReport(payload) {
 <meta name="ProgId" content="Word.Document">
 <meta name="Generator" content="Microsoft Word 15">
 <title>FAD-Checker Report</title>
-<style>${CSS}
-/* In Word: keep every detail row expanded since scripts are disabled */
-tr.detail-row { display: table-row !important; }
-</style>
+${WORD_SECTION_PR}
+<style>${CSS}${WORD_CSS}</style>
 </head>
-<body>${body}</body>
+<body><div class="WordSection1">${body}</div></body>
 </html>`;
 }
 

package/lib/nvd.js

@@ -18,6 +18,10 @@ const { getNvdApiKey } = require("./config");
 
 const NVD_CACHE_DIR = path.join(os.homedir(), ".fad-checker", "nvd-cache");
 const NVD_CACHE_TTL_MS = 7 * 24 * 3600 * 1000;
+// Bump whenever `extractFromNvdRecord` adds a new field — pre-bump cache
+// entries are treated as cache-miss so we re-fetch and pick up the new field.
+// 2: added `cwes` (Common Weakness Enumeration list).
+const NVD_CACHE_SCHEMA = 2;
 const NVD_BASE = "https://services.nvd.nist.gov/rest/json/cves/2.0";
 
 function getRateDelay() {
@@ -43,6 +47,8 @@ function readCache(cveId) {
 	if (!fs.existsSync(p)) return null;
 	try {
 		const data = JSON.parse(fs.readFileSync(p, "utf8"));
+		// Schema mismatch → force re-fetch so newly-added fields (e.g. cwes) get populated.
+		if ((data._schema || 1) < NVD_CACHE_SCHEMA) return null;
 		if (Date.now() - data._fetchedAt < NVD_CACHE_TTL_MS) return data.body;
 	} catch { /* ignore */ }
 	return null;
@@ -50,7 +56,7 @@ function readCache(cveId) {
 
 function writeCache(cveId, body) {
 	fs.mkdirSync(NVD_CACHE_DIR, { recursive: true });
-	fs.writeFileSync(cachePath(cveId), JSON.stringify({ _fetchedAt: Date.now(), body }));
+	fs.writeFileSync(cachePath(cveId), JSON.stringify({ _schema: NVD_CACHE_SCHEMA, _fetchedAt: Date.now(), body }));
 }
 
 function bestMetric(metrics) {

package/package.json

@@ -1,14 +1,14 @@
 {
   "name": "fad-checker",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "Fucking Autonomous Dependency Checker — multi-ecosystem CVE / EOL / outdated / vendored-JS scanner for Maven, npm and Yarn monorepos. Self-contained HTML + Word report.",
   "license": "MIT",
-  "author": "N8tz <n8tz.js@gmail.com>",
+  "author": "pp9Ping <pp9Ping@gmail.com>",
   "maintainers": [
-    "Nathan Braun <n8tz.js@gmail.com>"
+    "pp9Ping <pp9Ping@gmail.com>"
   ],
   "contributors": [
-    "N8tz (https://github.com/N8tz)"
+    "pp9Ping <pp9Ping@gmail.com>"
   ],
   "bin": {
     "fad-checker": "fad-checker.js",

package/test/cve-match.test.js

@@ -61,6 +61,19 @@ test("vendorMatchesGroup rejects substring leaks (H2)", () => {
 	assert.equal(vendorMatchesGroup("springframework", "org.springframework.boot"), true);
 });
 
+test("vendorMatchesGroup tokenizes multi-word legal-entity vendors", () => {
+	// NVD records the logback vendor as "qos.ch sarl" — a legal entity name.
+	// Neither equality nor plain dot-segment catches it, but tokenization on
+	// non-alphanumerics finds "qos"/"ch" as group segments and confirms the
+	// match. Without this, real logback CVEs landed in tier "possible".
+	assert.equal(vendorMatchesGroup("qos.ch sarl", "ch.qos.logback"), true);
+	assert.equal(vendorMatchesGroup("the apache software foundation", "org.apache.commons"), true);
+	// A single-token vendor must NOT be tokenized into substrings — that
+	// would re-introduce the H2 leak (e.g. "open" → ["open"] alone never
+	// matches arbitrary "org.opensaml.*").
+	assert.equal(vendorMatchesGroup("open", "org.opensaml.core"), false);
+});
+
 test("matchDepsAgainstCves hides 'possible' tier by default (H3)", () => {
 	// product matches `log4j-core` but vendor `acme` doesn't match groupId.
 	// Without opts.includePossibleTier we expect zero matches.

package/test/cve-report.test.js

@@ -60,6 +60,98 @@ test("generateWordReport contains Word XML namespaces", () => {
 	assert.ok(doc.includes("Word.Document"));
 });
 
+test("generateHtmlReport wraps tables with copy buttons", () => {
+	const html = generateHtmlReport({
+		cveMatches: sampleMatches,
+		eolResults: [], obsoleteResults: [], outdatedResults: [],
+		projectInfo,
+	});
+	// Wrapper div + copy button injected around every table
+	assert.ok(html.includes('class="table-wrap"'), "should wrap tables");
+	assert.ok(html.includes('class="btn-copy"'), "should have copy buttons");
+	assert.ok(html.includes("📋 Copy table"), "button label");
+	// Copy script wired up
+	assert.ok(html.includes("navigator.clipboard"), "should include clipboard script");
+	assert.ok(html.includes("inlineStylesForWord"), "should inline styles for Word paste");
+});
+
+test("generateWordReport does NOT wrap tables (no copy buttons in .doc)", () => {
+	const doc = generateWordReport({
+		cveMatches: sampleMatches,
+		eolResults: [], obsoleteResults: [], outdatedResults: [],
+		projectInfo,
+	});
+	assert.ok(!doc.includes('class="table-wrap"'), "no wrapper in Word output");
+	assert.ok(!doc.includes('class="btn-copy"'), "no copy buttons in Word output");
+});
+
+test("CWE human names are shown in the CVE table and detail panel", () => {
+	const html = generateHtmlReport({
+		cveMatches: sampleMatches.map(m => ({
+			...m,
+			cve: { ...m.cve, cwes: ["CWE-502", "CWE-917"] },
+		})),
+		eolResults: [], obsoleteResults: [], outdatedResults: [],
+		projectInfo,
+	});
+	// Detail panel: full name inline
+	assert.ok(html.includes("Deserialization of Untrusted Data"), "CWE-502 name in panel");
+	assert.ok(html.includes("Expression Language Injection"), "CWE-917 name in panel");
+	// Tooltip on the column link
+	assert.ok(html.includes('title="CWE-502: Deserialization of Untrusted Data"'), "tooltip");
+	// Weaknesses section in detail panel
+	assert.ok(html.includes("Weaknesses (CWE)"), "weaknesses section heading");
+	assert.ok(html.includes('class="cwe-list"'), "CWE list rendered");
+});
+
+test("Executive summary surfaces primary CWE name on each preview row", () => {
+	const html = generateHtmlReport({
+		cveMatches: [{
+			dep: { groupId: "org.apache.logging.log4j", artifactId: "log4j-core", version: "2.14.0", scope: "compile" },
+			cve: { id: "CVE-2021-44228", severity: "CRITICAL", score: 10, description: "Log4Shell", fixVersion: "2.15.0", cwes: ["CWE-502", "CWE-917"] },
+			confidence: "exact",
+		}],
+		eolResults: [], obsoleteResults: [], outdatedResults: [],
+		projectInfo,
+	});
+	assert.ok(html.includes('class="exec-cwe"'), "exec-cwe chip in summary");
+	assert.ok(html.includes('class="exec-cwe-id">CWE-502'), "id in chip");
+	assert.ok(html.includes("Deserialization of Untrusted Data"), "human name in chip");
+});
+
+test("Unknown CWE falls back to id-only display", () => {
+	const html = generateHtmlReport({
+		cveMatches: [{
+			dep: { groupId: "x", artifactId: "y", version: "1", scope: "compile" },
+			cve: { id: "CVE-2099-9999", severity: "HIGH", description: "n/a", cwes: ["CWE-99999"] },
+		}],
+		eolResults: [], obsoleteResults: [], outdatedResults: [],
+		projectInfo,
+	});
+	assert.ok(html.includes("CWE-99999"), "unknown CWE id present");
+	assert.ok(html.includes("(unknown weakness)"), "fallback label for unknown CWE in detail panel");
+});
+
+test("generateWordReport applies width:100% to every table for Word page-fit", () => {
+	const doc = generateWordReport({
+		cveMatches: sampleMatches,
+		eolResults: [], obsoleteResults: [], outdatedResults: [],
+		projectInfo,
+	});
+	// Every <table> rewritten with width="100%" + inline style (incl. fixed table-layout)
+	assert.ok(doc.includes('width="100%"'), "tables get width=100% attribute");
+	assert.ok(doc.includes("table-layout:fixed"), "tables get fixed layout");
+	// Word section + landscape page setup
+	assert.ok(doc.includes('class="WordSection1"'), "WordSection1 wrapper");
+	assert.ok(doc.includes("mso-page-orientation: landscape"), "landscape declared via mso-* property");
+	assert.ok(doc.includes("29.7cm 21cm"), "explicit A4 landscape dimensions");
+	// MSO conditional comment block with twips-based <w:sectPr> equivalent
+	assert.ok(doc.includes("w:WordDocument"), "Word document XML block");
+	assert.ok(doc.includes("16838twips"), "twips-based page size in mso conditional");
+	// Colgroups injected so fixed-layout tables have deterministic column widths
+	assert.ok(doc.includes('<colgroup>'), "colgroup injected on tables");
+});
+
 test("writeReports writes both files to disk", async () => {
 	const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "fad-checker-rep-"));
 	const r = await writeReports({

package/CRITICAL-REVIEW.md

@@ -1,343 +0,0 @@
-# fad-checker — Analyse critique complète
-
-**Date :** 2026-05-22
-**Périmètre :** intégralité du code (`fad-checker.js` + `lib/**/*.js` + `data/*.json` + `test/`)
-**Méthode :** 4 audits parallèles à effort xhigh (reuse / quality / efficiency / **faux positifs**)
-**Verdict global :** architecture saine, mais **4 chemins fail-open en cascade dans le matcher CVE** produisent un taux de faux positifs estimé entre **20 % et 60 %** selon le niveau de confiance retenu. À traiter en priorité avant toute exploitation en production.
-
----
-
-## TL;DR — Risque de faux positifs
-
-| Tier de confiance | Taux de FP estimé sur ~500 deps | Recommandation |
-|---|---|---|
-| `exact` uniquement | 5–10 % | Utilisable (triage léger) |
-| `exact` + `probable` | 20–30 % | Triage manuel obligatoire |
-| Tous tiers (`exact` + `probable` + `possible`) | **40–60 %** | Inexploitable sans tri humain |
-
-Quatre fail-open en cascade :
-
-1. **H1** — `isVersionAffected` retourne `true` quand le CVE n'a aucune borne de version (`lib/maven-version.js:101-124`).
-2. **H2** — `vendorMatchesGroup` fait du *substring matching* (`g.includes(v) || v.includes(g)`) — `vendor="open"` matche `org.opensaml.*` (`lib/cve-match.js:164-173`).
-3. **H3** — Tier-3 `possible` émis pour toute collision d'`artifactId`, même quand le vendor est totalement étranger (`lib/cve-match.js:191-198`).
-4. **H4** — Le filtre CPE (« primary FP filter ») se contente de **marquer** `cpeFiltered=true`, il ne supprime jamais (`lib/cpe.js:269-272`).
-
-Ces quatre interagissent de manière pathologique : H3 laisse passer une masse de matches `possible`, H2 en remonte beaucoup en `probable`, H1 valide toutes les versions, et H4 ne filtre plus rien en aval.
-
----
-
-## A. Faux positifs (critère #1 demandé)
-
-### HIGH
-
-#### H1 — `isVersionAffected` fail-open quand pas de bornes
-**Fichier :** `lib/maven-version.js:101-124`
-
-```js
-if (spec.version && spec.version !== "0" && spec.version !== "*") { /* lower */ }
-if (spec.lessThan)        { ... }
-if (spec.lessThanOrEqual) { ... }
-if (!spec.lessThan && !spec.lessThanOrEqual && spec.version && …) { /* exact */ }
-return true;   // ← fall-through "affected"
-```
-
-Empiriquement : `isVersionAffected("2.14", { status: "affected" })` → `true`. CVEProject contient régulièrement des entrées `versions:[{status:"affected"}]` sans bornes (stub mal formé). Combiné à H2, **toute dep qui hit le `byProduct` tier-2 avec un range sparse est flaggée sur toute version**.
-
-**FP concret :** CVE listant `affected: [{ product: "log4j", versions: [{ status: "affected" }] }]` → flag `log4j-core 2.99.0` (patché) car pas de borne haute, pas d'exact-match, fall-through → `true`.
-
-**Fix :**
-```js
-if (!spec.version && !spec.lessThan && !spec.lessThanOrEqual) return false;
-```
-
----
-
-#### H2 — `vendorMatchesGroup` substring-match → cross-vendor leak
-**Fichier :** `lib/cve-match.js:164-173`
-
-```js
-if (g.includes(v) || v.includes(g)) return true;
-```
-
-`vendorMatchesGroup("spring", "foospringbar")` → `true`. NVD/CVEProject contiennent régulièrement des vendors `"a"`, `"oss"`, `"com"`, `"java"`, `"go"`, `"web"`, `"open"`, `"ibm"`, `"net"` — tous présents en sous-chaîne dans des groupIds réels.
-
-**FP concrets :**
-- CVE `vendor="open"` matche `org.opensaml:opensaml-core` (`"opensaml".includes("open")`).
-- CVE `vendor="ibm"` matche `com.ibmcloudant:cloudant-client`.
-- CVE `vendor="spring"` matche `org.springframework.*` ET `com.foospringbar.*`.
-
-**Fix :** restreindre à (a) `g === v`, (b) `g.split(".").includes(v)`, (c) `v.includes(g)` seulement si `g.length >= 4`. Drop des branches substring non bornées.
-
----
-
-#### H3 — Tier-3 `possible` émis avec vendor totalement étranger
-**Fichier :** `lib/cve-match.js:191-198`
-
-```js
-const productMatches = byProduct[dep.artifactId.toLowerCase()] || [];
-for (const e of productMatches) {
-  if (vendorMatchesGroup(e.vendor, dep.groupId)) {
-    all.push(...matchOne(dep, [e], "probable"));
-  } else {
-    all.push(...matchOne(dep, [e], "possible"));   // ← émis quand même
-  }
-}
-```
-
-Toute dep dont l'`artifactId` collide avec un produit non relié produit un match `possible`. Collisions fréquentes : `core`, `common`, `api`, `client`, `utils`, `parser`, `web`. Une CVE avec `product="core"` flagge **toutes** les deps `*-core`.
-
-**Fix :** drop le tier `possible` ou ne l'afficher que si la refinement CPE (`refineMatchesWithCpe`) l'a confirmé.
-
----
-
-#### H4 — CPE refinement flagge sans supprimer
-**Fichier :** `lib/cpe.js:269-272`
-
-```js
-if (!affected && rec.configurations.length) {
-  m.cpeFiltered = true;     // ← marqué, jamais supprimé
-}
-```
-
-`cpeFiltered` est un soft tag. Si `lib/cve-report.js` ne strippe pas `cpeFiltered === true` (à vérifier dans le rendu), **les matches prouvés faux positifs restent dans la punch list**.
-
-De plus, le skip `if (!rec.configurations.length && !rec.cpes.length) continue;` (`cpe.js:266`) est fail-open : une CVE sans configurations NVD (CVE récente ou réservée) est laissée au tier que le matcher lui a donné.
-
-**Fix :** (a) filtrer par défaut `cpeFiltered=true` avec flag `--show-filtered`, ou (b) section séparée « likely false positive » dans le report.
-
----
-
-#### H5 — Le qualificateur CPE `update` (RC, alpha) est ignoré
-**Fichier :** `lib/cpe.js:81-100` (`matchVersionRange`)
-
-Le champ index 6 du CPE 2.3 (`update`) est parsé mais jamais comparé. NVD liste fréquemment les pré-releases via le champ update (`cpe:2.3:a:vendor:product:1.0.0:rc1:*…`). Le hard-pin compare littéralement la `version` ignorant `update` :
-
-```js
-if (parsed.version && parsed.version !== "*" && parsed.version !== "-") {
-  try { return compareMavenVersions(depVersion, parsed.version) === 0; }
-```
-
-→ `criteria: cpe:2.3:a:apache:foo:1.0.0:beta1:*…` matche `dep=1.0.0` (release). FP.
-
-**Fix :** si `update` n'est ni `*` ni `-`, concaténer (`${version}-${update}`) avant `compareMavenVersions` (qui gère déjà `1.0.0-beta1`).
-
-### MEDIUM
-
-#### M1 — `compareMavenVersions` accepte du garbage sans broncher
-**Fichier :** `lib/maven-version.js:25-94`
-
-`compareMavenVersions("${foo}", "1.0")` → `-1`. Une variable Maven non résolue est comparée comme une vraie version. La pipeline filtre `/\$\{/.test(dep.version)` dans `expandWithTransitives`, `queryOsvForDeps`, `checkOutdatedDeps` — **mais pas dans `matchDepsAgainstCves`** (`cve-match.js:151-162`). Donc dep avec version `${foo}` → `isVersionAffected("${foo}", range)` → fall-through `true` (H1).
-
-**Fix :** skipper les deps avec `${…}` non résolu dans `matchDepsAgainstCves`.
-
----
-
-#### M2 — OSV : stubs cachés ré-émis sur la mauvaise version
-**Fichier :** `lib/osv.js:242-265` (`runMatches`)
-
-`vulnToMatch` ne refait pas de check range local. Le cache key `(g, a, v)` est versionné, donc pour la même dep+version c'est sûr. Mais le branch « stub only » émet `severity: "UNKNOWN"` sans description — vrai FP si la dep a été upgradée entre la build du cache et le scan.
-
-`dep.version` avec `1.0.0.Final` ou `1.0.0.RELEASE` est envoyée verbatim à OSV qui ne normalise pas → recall patchy (FN, pas FP).
-
-**Fix :** toujours évaluer `vuln.affected[].ranges` localement avant d'émettre. Drop des matches stub-only.
-
----
-
-#### M3 — `parseRange` exporté mais jamais appelé
-**Fichier :** `lib/maven-version.js:131-146`
-
-`parseRange` traite les ranges Maven (`[1.0,2.0)`) mais aucun caller. Une `<version>[1.0,2.0)</version>` est passée verbatim à `compareMavenVersions("[1.0,2.0)", spec.version)`. Le tokenizer split sur `[.\-]`, `[1` devient un segment string → ranking sub-release → typiquement FN, mais peut devenir FP via H1.
-
-**Fix :** câbler `parseRange` dans la pipeline ; sinon reporter ces deps en `unresolved-versions`.
-
----
-
-#### M4 — `cpeMatchesDep` ré-introduit le substring leak de H2
-**Fichier :** `lib/cpe.js:170-173`
-
-Le filtre CPE supposé *narrow* contient lui-même la même heuristique substring que H2. Après que H2 fait passer un match, ce leak l'empêche de le re-filtrer.
-
----
-
-#### M5 — retire.js passé sans validation locale
-**Fichier :** `lib/retire.js:148-193`
-
-Le wrapper a accès à `below`/`atOrAbove` mais ne les compare jamais. Les régressions historiques des signatures retire (matchs sur des bundles non reliés) passent. Pas d'équivalent à `--includeOsvData` / `--ignorefile`.
-
-retire émet aussi un CVE id synthétique `RETIRE-<component>-<version>` qui ne dédup jamais contre fad/osv/nvd → **même vuln rapportée 2 fois**.
-
----
-
-#### M6 — Cohérence des clés `byProduct`
-**Fichier :** `lib/cve-download.js:163-164` + `lib/cve-match.js:191`
-
-Index keyé sur `a.product` brut, lookup sur `.toLowerCase()`. Actuellement safe car `extractAffectedRanges` lowercase upstream — mais fragile. À documenter ou normaliser explicitement.
-
-### LOW
-
-- **L1** — `data/known-obsolete.json:92-96` : `struts2-core` flaggé HIGH sans gate de version (Struts 2.5.30 patché remonte « obsolete »).
-- **L2** — `findCycleForVersion` (`lib/outdated.js:79-86`) prefix-match OK, pas de FP trouvé.
-- **L3** — Tests : aucun ne couvre les edge cases ci-dessus (no-bounds, substring vendor leak, possible tier, update CPE, garbage `${...}`, `parseRange`).
-
-### Verdict faux positifs
-
-**Architecture saine, implémentation fail-open.** Les 4 cascades (H1+H2+H3+H4) doivent être patchées avant prod.
-
-Patches prioritaires (ordre) :
-1. H1 → one-liner, plus gros gain
-2. H2 → tightening de `vendorMatchesGroup`
-3. H3 → cacher le tier `possible` par défaut
-4. H4 → strip `cpeFiltered:true` du report par défaut
-5. M1 → skip `${...}` dans `matchDepsAgainstCves`
-6. M2 → re-eval local des OSV ranges
-
----
-
-## B. Code reuse
-
-### HIGH
-
-- **Helper de cache disque triplicé** : `lib/osv.js:25-44`, `lib/nvd.js:28-45`, `lib/retire.js:27-45`. Pattern identique (`_fetchedAt` + TTL + JSON). `lib/outdated.js:22-37` même chose avec shape différent.
-  → Extraire `lib/cache-disk.js` exportant `makeCache(dir, ttlMs)`.
-
-- **`severityFromScore` + `SEVERITY_RANK` dupliqués 7+ fois** : `lib/nvd.js:64-71`, `lib/cve-download.js:82-89`, `lib/osv.js:60-66`, `lib/cve-match.js:9`, `lib/snyk.js:112`, `lib/cve-report.js:{634, 761, 1085, 1280}`, `fad-checker.js:657`.
-  → `lib/severity.js` + `sortMatchesBySeverity()` helper.
-
-- **Merge-by-source logic dupliquée** : `fad-checker.js:628-665` (`mergeBySource`) vs `lib/snyk.js:97-120` (`mergeWithFadResults`). Le `"both"` de Snyk désaccorde avec le `"fad+osv"` ailleurs.
-  → Promouvoir `mergeBySource` dans `lib/cve-match.js`.
-
-### MEDIUM
-
-- **`depLabel` / `depToKey` réinventés 6 fois** : `fad-checker.js:551`, `lib/cpe.js:177-184`, `lib/osv.js:100-102`, `lib/cve-report.js:{648, 669, 773, 1296}`.
-- **Walker de répertoires + `SKIP_DIRS` dupliqués 4 fois** : `lib/core.js:9-37`, `lib/npm/parse.js:253-284`, `lib/npm/collect.js:202-222`, `lib/retire.js:77-81`.
-- **Deux parsers POM divergents** : `lib/core.js:49-117` vs `lib/transitive.js:111-158`. Légitime (besoins différents) mais extraction parent/coord en commun possible.
-- **CLI hand-roll argv parsing** : `fad-checker.js:25-150` walk de `process.argv` pour `--completion`, `--set-nvd-key`, etc. — devrait être des subcommands `commander`.
-
-### LOW
-
-- 3 comparateurs de versions divergents : `compareMavenVersions`, `compareVersionsLoose` (`cve-report.js:705-715`), `semverCompare` (`npm/collect.js:25-37`).
-- `parseMavenMetadataLatest` (`outdated.js:212-224`) en regex au lieu d'xml2js (OK car XML trivial).
-
-### Modules clean
-`maven-version.js`, `maven-repo.js`, `config.js`, `scan-completeness.js`, `cache-archive.js`.
-
----
-
-## C. Code quality
-
-### HIGH
-
-- **`fad-checker.js` (665 lignes) = god script** : pré-parse argv mélangé à l'orchestration, business logic dans la CLI.
-- **`lib/cve-report.js` (1455 lignes) = mega-module** : CSS inline (~200 lignes), JS inline (`TOGGLE_SCRIPT`), business logic (`buildFixRecommendations`, `versionJump`, `pickTopCriticalMatches`) et rendu HTML dans le même fichier. `RENDER_CTX` module-global (lignes 247-249) reset à chaque `buildBody` — comment auto-avoue le workaround.
-  → Splitter en `lib/report/{css,html,recommendations,word}.js`. Passer `srcRoot` en paramètre.
-- **Stringly-typed partout** : `"fad" | "osv" | "nvd" | "snyk" | "retire"` en chaînes nues + class CSS `.source.snyk` qui couple le HTML à ces littéraux. Renommer une source casse silencieusement le CSS.
-  → `lib/keys.js` + `SOURCES = Object.freeze({...})`.
-
-### MEDIUM
-
-- **Param sprawl sur `writeReports` / `buildBody` / `renderExecutiveSummary`** — 10 champs disjoints recomposés à chaque appel.
-- **CVE matcher : duplication structurelle tier-2/tier-3** (`cve-match.js:175-219`) — flatten en single loop avec ternaire.
-- **Lockfile parsers v1 vs v2/v3 collés en un seul `parsePackageLock`** (`npm/parse.js:76-176`) — splitter.
-- **~30 `catch {}` silencieux** dans tout le code. Beaucoup légitimes, certains masquent des bugs réels (`osv.js:233`, `outdated.js:187,201`, `fad-checker.js:259`).
-- **`RENDER_CTX` global** → thread `srcRoot` via les signatures (3 niveaux max).
-- **Skip-dir lists copy-collées 4x** avec divergence `build/` (Maven keep, JS skip) — documenter une fois.
-- **`lib/core.js:230-235`** repeat parent-resolution dans `rewritePoms` — consolider.
-
-### LOW
-
-- Cache helpers ré-implémentés (cf. reuse).
-- Commentaires narratifs sans valeur (`cve-report.js:404-406`, `cve-report.js:519-521`, `transitive.js:204-206`, `fad-checker.js:202`).
-- Pollution `byId` potentielle via `excludedById`/`missingById` (`core.js:240-285`) — appliquer le guard du CLAUDE.md.
-- `lib/osv.js:188` arithmétique d'index fragile (`(batchIdx - 1) * BATCH_SIZE + j`) — utiliser `i + j`.
-- Verbosité booléenne threadée 4+ niveaux → `lib/log.js`.
-
----
-
-## D. Efficiency
-
-### HIGH
-
-- **CVE index loadé eagerly** (`lib/cve-download.js:299-301`) : `JSON.parse(readFileSync)` synchrone même pour un projet de 3 deps. Charger async + lazy par bucket.
-- **`cpe.js` re-parse les CPE et walk 2 fois** (`cpe.js:194-245`) : `parseCpe23` appelé répétitivement, walk pour confidence après le walk d'évaluation. 2M+ string-splits sur un projet 800 deps × 50 matches.
-  → Cache `m._parsed ||= parseCpe23(m.criteria)` + retour du match satisfaisant.
-- **NVD enrichment 100 % serial** (`nvd.js:186-203`) : `sleep(600|6000)` entre chaque appel. 200 CVEs uniques = 2 min avec clé, **20 min sans**. NIST policy = 50/30s window → permet parallélisme.
-- **TOCTOU `existsSync` + `readFile`** dans `transitive.js:52`, `nvd.js:34`, `osv.js:33`, `retire.js:32-37`, `outdated.js:22-25`. Doublé syscalls.
-- **`outdated.checkOutdatedDeps` cache reset global** (`outdated.js:230`) : `cache.entries = {}` si meta TTL périmé → 600 deps refetch même si entrées fraîches.
-  → TTL par-entrée.
-
-### MEDIUM
-
-- `findEolProduct` re-sort la prefix-list dans la boucle (`outdated.js:46-52`) — sort once at module load.
-- `outByKey` Map rebuild 6x dans `cve-report.js` (`:633-679`, `:760-795`, `:993-1003`) — builder once dans `buildBody`.
-- CVE bulk JSON `readFileSync` per file (`cve-download.js:274-287`) — borné par cache 24h, MEDIUM.
-- `cve-report.js` : `renderDetailPanel` (`:417-493`) + `groupExternalRefs` (`:340`) re-alloués par row → 45k allocations sur un report 5k rows. Pré-classifier à l'enrichment NVD.
-- **POMs parsés 2x sur le chemin `rewritePoms`** (`core.js:50` puis re-read à `:219`). `structuredClone` ou skip re-parse en read-only.
-- **`transitive.js:314` : `queue.shift()` O(n)** sur 4000+ transitives → 16M memmoves. Switch en cursor.
-- **Maven Central : pas de batch endpoint** (`outdated.js:176`) — solrsearch accepte OR boolean. 600 deps → 1 requête au lieu de 600.
-- **OSV detail fetch serial** dans `queryBatch` (`osv.js:218-236`) — `p-limit(10)` similaire à fad-checker.js.
-
-### LOW
-
-- `getAllInheritedProps` rebuild via spread — fine en dessous de 10k POMs.
-- `xml2js` 3-5x plus lent que `fast-xml-parser` — hors scope.
-- Eager `require("chalk")` etc. — invisible.
-
-### Note positive
-Le matcher CVE (`matchDepsAgainstCves`) est **Map-indexé correctement** (`byPackageName` / `byProduct` pré-bucketés) — pas de O(n²) sur le hot path.
-
----
-
-## E. Recommandations priorisées
-
-| # | Action | Severity | Effort | Impact |
-|---|---|---|---|---|
-| 1 | Patch `isVersionAffected` fail-closed (H1) | HIGH FP | 1 ligne | Énorme |
-| 2 | Tighten `vendorMatchesGroup` substring (H2) | HIGH FP | 10 lignes | Énorme |
-| 3 | Drop ou hide tier `possible` (H3) | HIGH FP | 5 lignes | Énorme |
-| 4 | Strip `cpeFiltered:true` du report (H4) | HIGH FP | 3 lignes | Gros |
-| 5 | Handle CPE `update` qualifier (H5) | HIGH FP | 15 lignes | Moyen |
-| 6 | Skip `${...}` dans matcher (M1) | MED FP | 3 lignes | Moyen |
-| 7 | OSV ranges re-eval local (M2) | MED FP | 30 lignes | Moyen |
-| 8 | Extract `lib/severity.js` + `SEVERITY_RANK` | HIGH reuse | 1h | Maintenance |
-| 9 | Extract `lib/cache-disk.js` | HIGH reuse | 1h | Maintenance |
-| 10 | NVD enrichment parallèle (token-bucket) | HIGH perf | 30min | 10x speedup |
-| 11 | Batch Maven Central Solr (#13 efficiency) | HIGH perf | 1h | 100x speedup |
-| 12 | `parseCpe23` memoization (CPE perf) | HIGH perf | 10min | 2-3x speedup |
-| 13 | Splitter `cve-report.js` en sous-modules | HIGH quality | 2h | Maintenance |
-| 14 | Tests des edge cases FP (`update`, no-bounds, substring) | LOW | 2h | Filet de sécurité |
-
-**Quick wins (< 1 jour cumulé)** : #1, #2, #3, #4, #6, #12 → diviserait le taux de FP par ~3-5 et accélérerait le rendu de ~2-3×.
-
----
-
-## F. Verdict final
-
-- **Architecture :** **bonne**. Séparation Maven/npm, 3-tier matching, post-CPE refinement, multi-source dedup, caches TTL — tout est en place.
-- **Implémentation matcher :** **fail-open systémique**. Les 4 cascades H1→H4 transforment un outil correctement architecturé en générateur de faux positifs.
-- **Performance :** correcte en CPU (Map-indexed), **mauvaise en I/O** (NVD serial, Solr unitaire, double-parse POM).
-- **Qualité :** 2 mega-modules (`cve-report.js` 1455 LoC, `fad-checker.js` 665 LoC) à splitter, ~30 `catch {}` à auditer, 7+ duplications de `SEVERITY_RANK`.
-- **Tests :** 96 tests existants mais happy-path-heavy ; aucune couverture des edge cases FP listés ci-dessus.
-
-**Recommandation pratique :** sans les patches H1-H4, le rapport doit être traité comme une **liste de départ pour triage manuel**, pas comme un inventaire de vulnérabilités exploitable. Le tier `exact` reste fiable. Tout le reste demande des yeux humains sur la description CVE avant action.
-
----
-
-## Annexe — Références fichier:ligne
-
-**Faux positifs :**
-- `lib/maven-version.js:25-94, 101-124, 131-146`
-- `lib/cve-match.js:9, 99-109, 151-162, 164-173, 175-219, 191-198`
-- `lib/cpe.js:25, 36-68, 81-100, 161-184, 194-245, 266, 269-272`
-- `lib/osv.js:25-44, 60-66, 100-102, 188, 218-236, 242-265, 273`
-- `lib/nvd.js:28-45, 64-71, 145, 186-203`
-- `lib/retire.js:24-45, 77-81, 148-193`
-- `lib/outdated.js:22-37, 46-52, 79-86, 168-187, 212-254`
-- `lib/cve-download.js:82-89, 163-164, 274-301`
-- `lib/transitive.js:51-101, 111-158, 204-235, 273-320`
-- `lib/core.js:9-37, 49-149, 219-285`
-- `lib/npm/{parse.js:76-291, collect.js:25-224}`
-- `lib/cve-report.js:48-247, 340, 404-493, 519-521, 559, 633-1455`
-- `fad-checker.js:25-150, 202, 259, 551, 628-665`
-- `data/{cpe-coord-map.json, known-obsolete.json:92-96}`
-
-**Tests manquants :** `test/{cpe,cve-match,maven-version}.test.js` — ajouter edge cases `update`, no-bounds, substring vendor leak, garbage version.