trace-sec 2.1.12 → 2.1.14

package/src/trace_engine/framework/fastapi.py

@@ -1,135 +1,216 @@
-"""FastAPI framework adapter for endpoint and attack-surface discovery."""
-
-import re
-from typing import List, Optional
-from trace_engine.parsing.parser import ParsedFile
-from trace_engine.framework.base import FrameworkAdapter, Endpoint, EndpointParameter
-from trace_engine.parsing.locations import SourceLocation
-
-HTTP_METHODS = {"get", "post", "put", "delete", "patch", "options", "head"}
-
-
-class FastAPIFrameworkAdapter(FrameworkAdapter):
-    """Detects and extracts FastAPI/Starlette routes and auth gates."""
-
-    def can_handle(self, parsed_file: ParsedFile) -> bool:
-        if parsed_file.language != "python":
-            return False
-        for imp in parsed_file.imports:
-            if "fastapi" in imp.module.lower() or "starlette" in imp.module.lower():
-                return True
-        return False
-
-    def extract_endpoints(self, parsed_file: ParsedFile, content: str) -> List[Endpoint]:
-        endpoints: List[Endpoint] = []
-        ep_count = 0
-
-        # Also search decorators in parsed functions
-        for fn in parsed_file.functions:
-            for dec in fn.decorators:
-                dec_text = dec.raw_text.strip()
-                # Pattern: @app.get('/path' ...) or @router.post('/path' ...)
-                match = re.search(
-                    r"""@?(?:[a-zA-Z0-9_]+)\.(get|post|put|delete|patch)\s*\(\s*["']([^"']+)["']""",
-                    dec_text,
-                    re.IGNORECASE,
-                )
-                if match:
-                    ep_count += 1
-                    method = match.group(1).upper()
-                    path = match.group(2)
-                    ep_id = f"ep_{parsed_file.file_path.replace('/', '_').replace('.', '_')}_{fn.name}_{method}"
-
-                    # Detect path parameters: {param_name}
-                    path_params = re.findall(r"\{([a-zA-Z0-9_]+)\}", path)
-                    params: List[EndpointParameter] = [
-                        EndpointParameter(name=p, location="path", required=True)
-                        for p in path_params
-                    ]
-
-                    # Detect function params from AST
-                    for p in fn.parameters:
-                        if p.name not in ("self", "cls") and p.name not in path_params:
-                            params.append(
-                                EndpointParameter(
-                                    name=p.name,
-                                    location="query" if method == "GET" else "body",
-                                    param_type=p.type_annotation or "string",
-                                )
-                            )
-
-                    # Analyze auth dependencies in decorator or args
-                    auth_required = False
-                    roles = []
-                    fn_body = fn.body_text or ""
-                    
-                    auth_indicators = [
-                        "current_user",
-                        "auth",
-                        "token",
-                        "security",
-                        "jwt",
-                        "oauth",
-                        "credentials",
-                        "verify_token",
-                        "api_key",
-                    ]
-                    for p in fn.parameters:
-                        p_ann = (p.type_annotation or "").lower()
-                        p_def = (p.default_value or "").lower()
-                        if any(ind in p.name.lower() or ind in p_ann or ind in p_def for ind in auth_indicators):
-                            auth_required = True
-                        if "admin" in p.name.lower() or "admin" in p_ann or "admin" in p_def:
-                            roles.append("admin")
-
-                    if "require_admin" in dec_text.lower() or "admin" in path.lower():
-                        roles.append("admin")
-                    if "current_user" in dec_text.lower() or "depends(get_current_user" in dec_text.lower():
-                        auth_required = True
-
-                    # Object identifier flag (e.g. /items/{id})
-                    has_obj_id = any(
-                        p in ("id", "user_id", "order_id", "product_id", "item_id")
-                        for p in path_params
-                    )
-
-                    # State changing
-                    state_changing = method in ("POST", "PUT", "DELETE", "PATCH")
-
-                    # Database access check
-                    db_access = any(
-                        term in fn_body.lower()
-                        for term in ("db.", "session.", "cursor.", "repository", "query(", ".filter(", "orders", "database", "find")
-                    )
-
-                    # Outbound network (SSRF indicator)
-                    ext_network = any(
-                        term in fn_body.lower()
-                        for term in ("requests.", "httpx.", "urllib.", "aiohttp.", "fetch(")
-                    )
-
-                    # Sensitive data
-                    sensitive = any(
-                        term in path.lower() or term in fn_body.lower()
-                        for term in ("password", "secret", "token", "credit", "card", "user", "order", "refund", "admin")
-                    )
-
-                    endpoints.append(
-                        Endpoint(
-                            id=ep_id,
-                            method=method,
-                            path=path,
-                            handler_name=fn.qualified_name,
-                            auth_required=auth_required,
-                            roles=list(set(roles)),
-                            parameters=params,
-                            database_access=db_access,
-                            object_identifier=has_obj_id,
-                            state_changing=state_changing,
-                            external_network=ext_network,
-                            sensitive_data=sensitive,
-                            source=fn.location,
-                        )
-                    )
-
-        return endpoints
+"""FastAPI framework adapter for endpoint and attack-surface discovery."""
+
+import re
+from typing import List, Optional
+from trace_engine.parsing.parser import ParsedFile
+from trace_engine.framework.base import FrameworkAdapter, Endpoint, EndpointParameter
+from trace_engine.parsing.locations import SourceLocation
+
+HTTP_METHODS = {"get", "post", "put", "delete", "patch", "options", "head", "websocket"}
+
+
+class FastAPIFrameworkAdapter(FrameworkAdapter):
+    """Detects and extracts FastAPI/Starlette routes, WebSockets, static mounts, and auth gates."""
+
+    def can_handle(self, parsed_file: ParsedFile) -> bool:
+        if parsed_file.language != "python":
+            return False
+        for imp in parsed_file.imports:
+            if "fastapi" in imp.module.lower() or "starlette" in imp.module.lower():
+                return True
+        return False
+
+    def extract_endpoints(self, parsed_file: ParsedFile, content: str) -> List[Endpoint]:
+        endpoints: List[Endpoint] = []
+        existing_keys = set()
+
+        # 1. Search decorators on parsed AST functions
+        for fn in parsed_file.functions:
+            for dec in fn.decorators:
+                dec_text = dec.raw_text.strip()
+                # Pattern: @app.get('/path' ...), @router.post('/path' ...), @app.websocket('/ws/...')
+                match = re.search(
+                    r"""@?(?:[a-zA-Z0-9_]+)\.(get|post|put|delete|patch|websocket|api_route)\s*\(\s*["']([^"']+)["']""",
+                    dec_text,
+                    re.IGNORECASE,
+                )
+                if match:
+                    raw_verb = match.group(1).upper()
+                    method = "WEBSOCKET" if raw_verb == "WEBSOCKET" else ("GET" if raw_verb == "API_ROUTE" else raw_verb)
+                    path = match.group(2)
+                    key = (method, path)
+                    if key in existing_keys:
+                        continue
+                    existing_keys.add(key)
+
+                    ep_id = f"ep_{parsed_file.file_path.replace('/', '_').replace('.', '_')}_{fn.name}_{method}"
+
+                    # Detect path parameters: {param_name}
+                    path_params = re.findall(r"\{([a-zA-Z0-9_]+)\}", path)
+                    params: List[EndpointParameter] = [
+                        EndpointParameter(name=p, location="path", required=True)
+                        for p in path_params
+                    ]
+
+                    # Detect function params from AST
+                    for p in fn.parameters:
+                        if p.name not in ("self", "cls") and p.name not in path_params:
+                            params.append(
+                                EndpointParameter(
+                                    name=p.name,
+                                    location="query" if method in ("GET", "WEBSOCKET") else "body",
+                                    param_type=p.type_annotation or "string",
+                                )
+                            )
+
+                    # Analyze auth dependencies in decorator or args
+                    auth_required = False
+                    roles = []
+                    fn_body = fn.body_text or ""
+
+                    auth_indicators = [
+                        "current_user",
+                        "auth",
+                        "token",
+                        "security",
+                        "jwt",
+                        "oauth",
+                        "credentials",
+                        "verify_token",
+                        "api_key",
+                        "require_admin",
+                        "get_current_user",
+                    ]
+                    for p in fn.parameters:
+                        p_ann = (p.type_annotation or "").lower()
+                        p_def = (p.default_value or "").lower()
+                        if any(ind in p.name.lower() or ind in p_ann or ind in p_def for ind in auth_indicators):
+                            auth_required = True
+                        if "admin" in p.name.lower() or "admin" in p_ann or "admin" in p_def:
+                            roles.append("admin")
+
+                    if "require_admin" in dec_text.lower() or "admin" in path.lower():
+                        roles.append("admin")
+                    if "current_user" in dec_text.lower() or "depends(" in dec_text.lower():
+                        auth_required = True
+
+                    # Object identifier flag: e.g. /items/{id}, /athlete/{athlete_id}, /coach/{coach_id}
+                    has_obj_id = any(
+                        p.lower() == "id" or p.lower().endswith("_id") or p.lower().endswith("id")
+                        for p in path_params
+                    )
+
+                    # State changing
+                    state_changing = method in ("POST", "PUT", "DELETE", "PATCH")
+
+                    # Database access check
+                    db_access = any(
+                        term in fn_body.lower()
+                        for term in ("db.", "session.", "cursor.", "repository", "query(", ".filter(", "database", "models.")
+                    )
+
+                    # Outbound network (SSRF indicator)
+                    ext_network = any(
+                        term in fn_body.lower()
+                        for term in ("requests.", "httpx.", "urllib.", "aiohttp.", "fetch(")
+                    )
+
+                    # Sensitive data
+                    sensitive = any(
+                        term in path.lower() or term in fn_body.lower()
+                        for term in ("password", "secret", "token", "credit", "card", "user", "order", "refund", "admin", "coach", "athlete", "story", "session")
+                    )
+
+                    endpoints.append(
+                        Endpoint(
+                            id=ep_id,
+                            method=method,
+                            path=path,
+                            handler_name=fn.qualified_name,
+                            auth_required=auth_required,
+                            roles=list(set(roles)),
+                            parameters=params,
+                            database_access=db_access,
+                            object_identifier=has_obj_id,
+                            state_changing=state_changing,
+                            external_network=ext_network,
+                            sensitive_data=sensitive,
+                            source=fn.location,
+                        )
+                    )
+
+        # 2. Detect StaticFiles mounts e.g. app.mount("/session_videos", StaticFiles(directory="session_videos"), name="session_videos")
+        mount_pattern = re.compile(
+            r"""(?:app|router)\.mount\s*\(\s*["']([^"']+)["']\s*,\s*StaticFiles\s*\(\s*(?:directory\s*=\s*)?["']([^"']+)["']""",
+            re.IGNORECASE,
+        )
+        for match in mount_pattern.finditer(content):
+            mount_path = match.group(1).rstrip("/")
+            directory = match.group(2)
+            line_no = content[:match.start()].count("\n") + 1
+            ep_id = f"ep_{parsed_file.file_path.replace('/', '_').replace('.', '_')}_mount_{directory}_GET"
+            key = ("GET", f"{mount_path}/{{filepath}}")
+            if key not in existing_keys:
+                existing_keys.add(key)
+                endpoints.append(
+                    Endpoint(
+                        id=ep_id,
+                        method="GET",
+                        path=f"{mount_path}/{{filepath}}",
+                        handler_name=f"StaticFiles({directory})",
+                        auth_required=False,
+                        roles=[],
+                        parameters=[
+                            EndpointParameter(name="filepath", location="path", required=True)
+                        ],
+                        database_access=False,
+                        object_identifier=True,
+                        state_changing=False,
+                        external_network=False,
+                        sensitive_data=True,
+                        source=SourceLocation(file=parsed_file.file_path, line_start=line_no, line_end=line_no),
+                    )
+                )
+
+        # 3. Direct regex fallback across raw content to catch routes missed by AST function traversal
+        raw_route_pat = re.compile(
+            r"""@(?:app|router|api_router)\.(get|post|put|delete|patch|websocket)\s*\(\s*["']([^"']+)["']""",
+            re.IGNORECASE,
+        )
+        for match in raw_route_pat.finditer(content):
+            raw_verb = match.group(1).upper()
+            method = "WEBSOCKET" if raw_verb == "WEBSOCKET" else raw_verb
+            path = match.group(2)
+            key = (method, path)
+            if key in existing_keys:
+                continue
+            existing_keys.add(key)
+
+            line_no = content[:match.start()].count("\n") + 1
+            path_params = re.findall(r"\{([a-zA-Z0-9_]+)\}", path)
+            has_obj_id = any(
+                p.lower() == "id" or p.lower().endswith("_id") or p.lower().endswith("id")
+                for p in path_params
+            )
+            endpoints.append(
+                Endpoint(
+                    id=f"ep_{parsed_file.file_path.replace('/', '_').replace('.', '_')}_L{line_no}_{method}",
+                    method=method,
+                    path=path,
+                    handler_name=f"route_L{line_no}",
+                    auth_required=False,
+                    roles=["admin"] if "admin" in path.lower() else [],
+                    parameters=[
+                        EndpointParameter(name=p, location="path", required=True)
+                        for p in path_params
+                    ],
+                    database_access=True,
+                    object_identifier=has_obj_id,
+                    state_changing=method in ("POST", "PUT", "DELETE", "PATCH"),
+                    external_network=False,
+                    sensitive_data="admin" in path.lower() or "user" in path.lower() or "session" in path.lower() or "story" in path.lower(),
+                    source=SourceLocation(file=parsed_file.file_path, line_start=line_no, line_end=line_no),
+                )
+            )
+
+        return endpoints

package/src/trace_engine/interactive.py

@@ -624,53 +624,57 @@ def run_interactive_story() -> None:
     )
 
     # =========================================================================
-    # STEP 7: Autonomous AST Self-Healing Opportunity
+    # STEP 7: AI Coding Agent Handoff & Export Options
     # =========================================================================
-    if findings:
-        console.print(f"\n  [{DIM_GREEN}]{'─' * 76}[/{DIM_GREEN}]")
-        console.print(f"  [{GREEN}]◆ AUTONOMOUS AST SELF-HEALING OPPORTUNITY:[/{GREEN}]")
-        console.print(f"    [{WHITE}]TRACE can synthesize surgical AST patches for detected flaws in {project_dir.name}.[/{WHITE}]")
-        console.print(f"    [{DIM_WHITE}]Includes transactional rollback protection and verification oracle testing.[/{DIM_WHITE}]\n")
-
-        heal_ans = ask_input(
-            f"  [{ORANGE}]›[/{ORANGE}] [{BOLD_WHITE}]Autonomously remediate verified vulnerabilities now? (y/n)[/{BOLD_WHITE}]",
-            choices=["y", "n", "yes", "no"],
-            default="n",
-        )
-        should_heal = heal_ans.lower() in ("y", "yes")
-
-        if should_heal:
-            from trace_engine.harness.engine import AgentHarness
-            with console.status(f"  [{GREEN}]Autonomous Harness:[/{GREEN}] [{WHITE}]Refactoring AST nodes & running verification...[/{WHITE}]", spinner="dots"):
-                harness = AgentHarness(project_dir, target_url=target_url)
-                report = harness.run_self_healing_loop()
-            print_harness_report(report)
-
-    # =========================================================================
-    # STEP 8: Post-Audit Export
-    # =========================================================================
-    console.print(f"\n  [{BOLD_WHITE}]Export Options:[/{BOLD_WHITE}]")
-    console.print(f"    [{ORANGE}][1][/{ORANGE}] [{BOLD_WHITE}]Export OASIS SARIF v2.1.0[/{BOLD_WHITE}] [{DIM_WHITE}](GitHub Code Scanning / CI Integration)[/{DIM_WHITE}]")
-    console.print(f"    [{ORANGE}][2][/{ORANGE}] [{BOLD_WHITE}]Export Markdown Report[/{BOLD_WHITE}] [{DIM_WHITE}](Executive summary document)[/{DIM_WHITE}]")
-    console.print(f"    [{ORANGE}][3][/{ORANGE}] [{BOLD_WHITE}]Finish Session[/{BOLD_WHITE}]\n")
-
-    post_choice = ask_input(
-        f"  [{ORANGE}]›[/{ORANGE}] [{BOLD_WHITE}]Select export option[/{BOLD_WHITE}]",
-        choices=["1", "2", "3"],
-        default="1",
+    console.print(f"\n  [{DIM_GREEN}]{'─' * 76}[/{DIM_GREEN}]")
+    console.print(f"  [{GREEN}]◆ TRACE AUDIT COMPLETE — AI AGENT & REMEDIATION HANDOFF:[/{GREEN}]")
+    console.print(f"    [{WHITE}]TRACE has generated precise root causes and concrete remediation plans for all {len(findings)} findings.[/{WHITE}]")
+    console.print(f"    [{DIM_WHITE}]Executive report automatically saved to:[/{DIM_WHITE}] [{BOLD_WHITE}]{project_dir / 'findings.md'}[/{BOLD_WHITE}]\n")
+
+    console.print(f"  [{BOLD_WHITE}]Next Action / Integration Options:[/{BOLD_WHITE}]")
+    console.print(f"    [{ORANGE}][1][/{ORANGE}] [{BOLD_WHITE}]Inspect Detailed Root Cause & Exploit Mechanics in Terminal[/{BOLD_WHITE}]")
+    console.print(f"    [{ORANGE}][2][/{ORANGE}] [{BOLD_WHITE}]Launch TRACE MCP Server[/{BOLD_WHITE}] [{DIM_WHITE}](Connect Claude Code / Cursor as skill)[/{DIM_WHITE}]")
+    console.print(f"    [{ORANGE}][3][/{ORANGE}] [{BOLD_WHITE}]Export OASIS SARIF v2.1.0[/{BOLD_WHITE}] [{DIM_WHITE}](GitHub Code Scanning / CI)[/{DIM_WHITE}]")
+    console.print(f"    [{ORANGE}][4][/{ORANGE}] [{BOLD_WHITE}]Finish Session[/{BOLD_WHITE}]\n")
+
+    handoff_choice = ask_input(
+        f"  [{ORANGE}]›[/{ORANGE}] [{BOLD_WHITE}]Select action[/{BOLD_WHITE}]",
+        choices=["1", "2", "3", "4"],
+        default="4",
         show_default=True,
     )
 
-    if post_choice == "1":
+    if handoff_choice == "1":
+        while True:
+            console.print(f"\n  [{BOLD_WHITE}]Available Findings to Inspect:[/{BOLD_WHITE}]")
+            for f in findings:
+                action_text = f.short_action or f.title
+                console.print(f"    [{GREEN}]• {f.id:<14}[/{GREEN}] [{WHITE}]{f.endpoint:<28}[/{WHITE}] [{DIM_WHITE}]{action_text}[/{DIM_WHITE}]")
+            f_id = ask_input(f"\n  [{ORANGE}]›[/{ORANGE}] [{BOLD_WHITE}]Enter Finding ID to inspect (or 'back')[/{BOLD_WHITE}]", default="back")
+            if f_id.lower() in ("back", "exit", "q"):
+                break
+            matched = next((f for f in findings if f.id.lower() == f_id.lower()), None)
+            if matched:
+                console.print()
+                print_finding_detail(matched)
+            else:
+                console.print(f"  [{ORANGE}]Finding '{f_id}' not found.[/{ORANGE}]")
+
+    elif handoff_choice == "2":
+        console.print(f"\n  [{GREEN}]Starting TRACE MCP Server on port 8765...[/{GREEN}]")
+        console.print(f"  [{DIM_WHITE}]Connect Claude Code or Cursor to: [bold white]http://127.0.0.1:8765/sse[/bold white][/{DIM_WHITE}]")
+        console.print(f"  [{DIM_WHITE}]Press Ctrl+C to stop the MCP server when finished.[/{DIM_WHITE}]\n")
+        from trace_engine.mcp.server import run_server
+        try:
+            run_server(host="127.0.0.1", port=8765)
+        except KeyboardInterrupt:
+            console.print(f"\n  [{GREEN}]✓ TRACE MCP Server stopped.[/{GREEN}]")
+
+    elif handoff_choice == "3":
         sarif_file = project_dir / "trace-results.sarif"
         sarif_data = generate_sarif_report(findings, project_name=project_dir.name, workspace_root=str(project_dir))
         import json
         sarif_file.write_text(json.dumps(sarif_data, indent=2), encoding="utf-8")
         console.print(f"  [{GREEN}]✓ Exported SARIF v2.1.0:[/{GREEN}] [{WHITE}]{sarif_file}[/{WHITE}]\n")
-    elif post_choice == "2":
-        md_file = project_dir / "TRACE_SECURITY_REPORT.md"
-        md_content = generate_markdown_report(findings, project_name=project_dir.name)
-        md_file.write_text(md_content, encoding="utf-8")
-        console.print(f"  [{GREEN}]✓ Exported Markdown Report:[/{GREEN}] [{WHITE}]{md_file}[/{WHITE}]\n")
 
     console.print(f"  [{GREEN}]✓ TRACE Audit Session Complete. System Verified.[/{GREEN}]\n")

package/src/trace_engine/mcp/server.py

@@ -218,6 +218,8 @@ class TraceMCPServer:
                     "severity": f.severity.value,
                     "confidence": f.confidence.value,
                     "endpoint": f.endpoint,
+                    "root_cause": f.root_cause,
+                    "short_action": f.short_action,
                     "remediation": f.remediation,
                     "source": str(f.source_location) if f.source_location else None,
                 }
@@ -239,6 +241,8 @@ class TraceMCPServer:
                 "endpoint": finding.endpoint,
                 "source": str(finding.source_location),
                 "attack_path": finding.attack_path,
+                "root_cause": finding.root_cause,
+                "short_action": finding.short_action,
                 "static_evidence": finding.static_evidence,
                 "runtime_evidence": finding.runtime_evidence,
                 "correlation_notes": finding.correlation_notes,

package/src/trace_engine/output/markdown.py

@@ -10,16 +10,18 @@ def generate_markdown_report(findings: List[Finding], project_name: str = "Appli
         f"# TRACE Security Assessment Report — {project_name}",
         "Threat Reconnaissance & Attack-path Correlation Engine",
         "",
-        "## Summary",
-        f"- Total Correlated Findings: **{len(findings)}**",
+        "## Executive Summary",
+        f"- **Target Application:** `{project_name}`",
+        f"- **Total Correlated Findings:** **{len(findings)}**",
         "",
-        "| ID | Severity | Confidence | Category | Endpoint | Title |",
+        "| ID | Severity | Confidence | Category | Endpoint | Remediation Action |",
         "|---|---|---|---|---|---|",
     ]
 
     for f in findings:
+        action_summary = f.short_action or f.title
         lines.append(
-            f"| {f.id} | {f.severity.value} | {f.confidence.value} | {f.category} | `{f.endpoint}` | {f.title} |"
+            f"| `{f.id}` | **{f.severity.value}** | {f.confidence.value} | {f.category} | `{f.endpoint}` | {action_summary} |"
         )
 
     lines.extend(["", "---", "", "## Finding Details", ""])
@@ -33,9 +35,13 @@ def generate_markdown_report(findings: List[Finding], project_name: str = "Appli
         if f.source_location:
             lines.append(f"- **Source:** `{f.source_location}`")
         lines.append("")
-        
+
+        if f.root_cause:
+            lines.append("#### Root Cause & Exploit Mechanics")
+            lines.append(f"{f.root_cause}\n")
+
         if f.attack_path:
-            lines.append("#### Attack Path Hops")
+            lines.append("#### Attack Path Hops (APM Traversal)")
             for hop in f.attack_path:
                 lines.append(f"1. `{hop}`")
             lines.append("")
@@ -58,7 +64,8 @@ def generate_markdown_report(findings: List[Finding], project_name: str = "Appli
                 lines.append(f"{idx}. {step}")
             lines.append("")
 
-        lines.append(f"#### Remediation Guidance\n{f.remediation}\n")
+        lines.append("#### Concrete Remediation Plan")
+        lines.append(f"{f.remediation}\n")
         lines.append("---")
         lines.append("")
 

package/src/trace_engine/output/terminal.py

@@ -220,6 +220,10 @@ def print_finding_detail(f: Finding) -> None:
             prefix = "  +- "
             content.append(f"{prefix}{hop}\n", style="dim white")
 
+    if f.root_cause:
+        content.append("\nRoot Cause & Exploit Mechanics:\n", style="bold green")
+        content.append(f"  {f.root_cause}\n", style="bright_white")
+
     if f.static_evidence:
         content.append("\nStatic Code Evidence:\n", style="bold green")
         for ev in f.static_evidence:
@@ -235,8 +239,10 @@ def print_finding_detail(f: Finding) -> None:
         for idx, step in enumerate(f.reproduction_steps, 1):
             content.append(f"  {idx}. {step}\n", style="white")
 
-    content.append("\nRemediation Guidance:\n", style="bold green")
-    content.append(f"  {f.remediation}\n", style="dim white")
+    content.append("\nConcrete Remediation Action Plan:\n", style="bold green")
+    for line in f.remediation.split("\n"):
+        if line.strip():
+            content.append(f"  {line}\n", style="white")
 
     console.print(
         Panel(
@@ -351,7 +357,7 @@ def print_test_all_report(
     for idx, f in enumerate(sorted_findings, 1):
         prio = priority_labels.get(f.severity, str(f.severity.value))
         loc_str = str(f.source_location) if f.source_location else "-"
-        remediation_snippet = f.remediation.strip().split(".")[0] + "." if f.remediation else "Apply strict authorization check."
+        remediation_snippet = f.short_action or (f.remediation.strip().split(".")[0] + "." if f.remediation else "Apply strict authorization check.")
 
         table.add_row(
             f"#{idx}",