engine_id: security_scan_review template_id: security-scan-report tier: m scan_id: 20260610-0841-scopelytics-deep-security-scan evidence_path: docs/security/evidence/20260610-0841-scopelytics-deep-security-scan severity_vocab_source: ../../shared/findings-common/severity-vocab.json

Security Scan Report: scopelytics-deep-security-scan

Security Verdict

• Verdict: FAIL
• Scan Mode: deep
• Scope: all
• Selection: default
• Env file policy: runtime env files excluded by default; shared/test env files remain in scope; this boundary is independent of git ignore handling
• Blocking issues: 4
• Highest severity: critical
• Coverage confidence: low
• Immediate next step: Review skipped or unavailable engines before treating clean categories as passed.

Issues That Matter Now

Main body is capped at top 5 issue groups; full audit detail stays in Appendix / summary.json / SARIF / evidence.

+1 more issue group(s) in Appendix / summary.json / SARIF / evidence.

Trust Notes

• sast: skipped; adapter-not-on-path
• supply_chain: skipped; no-deterministic-adapter-binding:security_scan_review:supply_chain

Next Step

• Next: evidence-gap review
• Why: Resolve material findings or missing adapter coverage before release-gate decisions.
• Default scope: SCA-001, SECRET-001, SCA-002, SCA-003, SCA-004
• Requires approval: yes; invoke th-writing-plans before implementation work
• Proof gate: Re-run this command or the agent-led /th-security-scan workflow after the implementation plan is executed.

Evidence

• docs/security/evidence/20260610-0841-scopelytics-deep-security-scan/raw - raw adapter outputs
• docs/security/evidence/20260610-0841-scopelytics-deep-security-scan/sarif/report.sarif - machine-readable security findings
• docs/security/evidence/20260610-0841-scopelytics-deep-security-scan/logs/summary.json - machine-readable summary for automation and audit
• docs/security/evidence/20260610-0841-scopelytics-deep-security-scan/logs - runner logs and JSON summaries
• docs/security/evidence/20260610-0841-scopelytics-deep-security-scan/sbom - SBOM evidence when generated by adapters
• docs/security/evidence/20260610-0841-scopelytics-deep-security-scan/hashes - artifact hashes when malware_ioc adapters emit them

Open Questions And Decision Needed

Appendix: Audit Detail

Full detail is intentionally outside the main body. Use this section only when a reviewer needs raw traceability beyond the first-screen issue summary. Machine-readable summary data lives in docs/security/evidence/20260610-0841-scopelytics-deep-security-scan/logs/summary.json.

Recommended Actions

Do not create a second docs/security remediation-plan companion by default.

JSON Summary

{
"scan_id": "20260610-0841-scopelytics-deep-security-scan",
"verdict": "FAIL",
"scan_mode": "deep",
"scope": "all",
"selection": "default",
"include_runtime_env_files": false,
"env_file_policy": {
  "default_include_runtime_env_files": false,
  "include_runtime_env_files": false,
  "path_pattern": ".env*",
  "default_included_shared_test_filenames": [
    ".env.example",
    ".env.sample",
    ".env.template",
    ".env.test"
  ],
  "runtime_env_classification_rules": [
    "Any .env* path not explicitly listed under default_included_shared_test_filenames is treated as a runtime env file by default.",
    "Local runtime variants remain runtime env files even when they contain test-like labels, for example .env.test.local.",
    "Explicit path scopes such as artifact_path=<path> or malware_path=<path> may still target a runtime env file intentionally; the default exclusion applies to curated/default scan surface resolution, not to explicit path targeting."
  ],
  "default_policy_summary": "Runtime env files are excluded from the default scan surface, including scope=all and scan_mode=deep. Shared/test env files remain in scope by default. This boundary is independent of git ignore handling.",
  "classification_owner_note": "Use this block as the single owner for env-file classification, default inclusion, and metadata wording.",
  "metadata_requirements": {
    "resolved_fields": [
      "include_runtime_env_files",
      "env_file_policy"
    ],
    "required_wording": "Report whether runtime env files were excluded by default or explicitly included, and distinguish that decision from git ignore handling and from shared/test env files that remain in scope."
  }
},
"confidence_threshold": 0.8,
"counts": {
  "critical": 46,
  "high": 152,
  "medium": 9,
  "low": 0
},
"excluded_counts": {
  "critical": 0,
  "high": 0,
  "medium": 0,
  "low": 0
},
"engines": {
  "secrets": {
    "status": "executed",
    "scanner": "gitleaks",
    "reason": "n/a"
  },
  "sast": {
    "status": "skipped",
    "scanner": "unavailable",
    "reason": "adapter-not-on-path"
  },
  "dependency_sca": {
    "status": "executed",
    "scanner": "osv_scanner,trivy",
    "reason": "n/a"
  },
  "iac_container": {
    "status": "executed",
    "scanner": "trivy",
    "reason": "n/a"
  },
  "supply_chain": {
    "status": "skipped",
    "scanner": "reasoning",
    "reason": "no-deterministic-adapter-binding:security_scan_review:supply_chain"
  },
  "malware_ioc": {
    "status": "executed",
    "scanner": "clamav,yara",
    "reason": "n/a"
  }
},
"per_category_verdict": {
  "secrets": "FAIL",
  "dependency_sca": "FAIL",
  "iac_container": "WARN",
  "sast": "NEEDS_REVIEW",
  "supply_chain": "NEEDS_REVIEW",
  "malware_ioc": "PASS"
},
"engine": "security_scan_review",
"auto_install_adapters": true,
"install_ledger_path": "docs/security/evidence/20260610-0841-scopelytics-deep-security-scan/logs/adapter-install-ledger.json",
"adapter_install_ledger": {
  "path": "docs/security/evidence/20260610-0841-scopelytics-deep-security-scan/logs/adapter-install-ledger.json",
  "install_ledger_path": "docs/security/evidence/20260610-0841-scopelytics-deep-security-scan/logs/adapter-install-ledger.json",
  "installer_invoked": true,
  "selected_tools": [
    "semgrep"
  ],
  "skipped_tools": [],
  "missing_tools": [
    "semgrep"
  ],
  "no_project_dependency_install": true,
  "no_download": true,
  "no_package_manager_operation": true
},
"sbom": {
  "sbom_generator": null,
  "sbom_generation_status": "not_generated",
  "sbom_fallback_reason": "no-sbom-capable-adapter-produced-output",
  "sbom_completeness": "unknown",
  "sbom_paths": [],
  "sbom_formats": []
},
"sbom_generator": null,
"sbom_generation_status": "not_generated",
"sbom_fallback_reason": "no-sbom-capable-adapter-produced-output",
"sbom_completeness": "unknown"
}

This summary lets agents and tools quickly verify verdict, counts, engines, scope, selection, env-file policy, and blocking decision state without parsing the prose sections.

Security Context

• Project type (concept-level): CI/CD configured
• Sensitive areas: env-file presence=False
• Scan limitations: deterministic runner is adapter-backed; agent reasoning-only coverage is surfaced as skipped when no local adapter ran.
• Path display policy: finding paths are rendered source-relative when adapters scan a temporary source-only mirror or explicit target under the repository.
• Env-file policy detail: Runtime env files are excluded from the default scan surface, including scope=all and scan_mode=deep. Shared/test env files remain in scope by default. This boundary is independent of git ignore handling.
• Resolved env-file metadata: include_runtime_env_files=False with env_file_policy embedded in the JSON summary for auditability.
• Machine-readable summary: docs/security/evidence/20260610-0841-scopelytics-deep-security-scan/logs/summary.json

Engines Executed

Standards Lenses Applied

Findings Ledger

CRITICAL Findings

SCA-001: Vulnerable dependencies require version upgrades: axios, next, xlsx (42 findings)

• Severity: CRITICAL
• Confidence: 0.9
• Category: dependency_sca
• Affected paths: package-lock.json:3689; package-lock.json:6692; package-lock.json:8634; yarn.lock:1179; yarn.lock:2719; +1 more
• What was found: Package: axios Installed Version: 1.13.5 Vulnerability CVE-2026-42033 Severity: HIGH Fixed Version: 1.15.1, 0.31.1 Link: CVE-2026-42033
• Exploit scenario: A vulnerable dependency version is resolved at build or runtime, exposing the application to the documented CVE / advisory attack class.
• Recommendation: Upgrade the affected package to a fixed version or apply the vendor-recommended mitigation; pin transitive dependencies if needed.
• Proof required: Re-run the scan after the fix; verify the finding no longer reproduces and the redaction invariant holds.
• Rule metadata: SCAN-DEPENDENCY-CVE-CVE-2026-42033; SCAN-DEPENDENCY-CVE-CVE-2026-42035; SCAN-DEPENDENCY-CVE-CVE-2026-42043; SCAN-DEPENDENCY-CVE-CVE-2026-42264; SCAN-DEPENDENCY-CVE-CVE-2026-44486; SCAN-DEPENDENCY-CVE-CVE-2026-44487; SCAN-DEPENDENCY-CVE-CVE-2026-44488; SCAN-DEPENDENCY-CVE-CVE-2026-44492; +13 more
• Evidence: package-lock.json:3689; package-lock.json:6692; package-lock.json:8634; yarn.lock:1179; yarn.lock:2719; +1 more

SECRET-001: Hardcoded secrets or credentials are present in scanned files (4 findings)

• Severity: CRITICAL
• Confidence: 0.9
• Category: secrets
• Affected paths: backend/.env.example:24; backend/.env.example:30; backend/scripts/run_bid_advisor_eval_dataset.py:16; backend/tests/conftest.py:15
• What was found: Gitleaks generic secret detector matched credential-like high-entropy text in C:[REDACTED:SCAN-HARDCODED-SECRET]-security-scan-filtered-8hmtelnh/secrets/001/backend/.env.example (scanner rule: generic-api-key).
• Exploit scenario: Secret embedded in source recoverable from version control or distribution.
• Recommendation: Rotate the credential, remove from history, and store in a secret manager.
• Proof required: Re-run the scan after rotation; verify the redaction invariant.
• Rule metadata: SCAN-HARDCODED-SECRET
• Scanner Rule ID(s): generic-api-key
• Evidence: backend/.env.example:24; backend/.env.example:30; backend/scripts/run_bid_advisor_eval_dataset.py:16; backend/tests/conftest.py:15

HIGH Findings

SCA-002: Vulnerable dependencies require version upgrades: axios, follow-redirects, next (42 findings)

• Severity: HIGH
• Confidence: 0.9
• Category: dependency_sca
• Affected paths: package-lock.json:3689; package-lock.json:5140; package-lock.json:6692; package-lock.json:6745; yarn.lock:1179; +3 more
• What was found: Package: axios Installed Version: 1.13.5 Vulnerability CVE-2025-62718 Severity: MEDIUM Fixed Version: 1.15.0, 0.31.0 Link: CVE-2025-62718
• Impact: A vulnerable dependency version is resolved at build or runtime, exposing the application to the documented CVE / advisory attack class.
• Recommendation: Upgrade the affected package to a fixed version or apply the vendor-recommended mitigation; pin transitive dependencies if needed.
• Proof required: Re-run the scan after the fix; verify the finding no longer reproduces and the redaction invariant holds.
• Rule metadata: SCAN-DEPENDENCY-CVE-CVE-2025-62718; SCAN-DEPENDENCY-CVE-CVE-2026-40175; SCAN-DEPENDENCY-CVE-CVE-2026-42034; SCAN-DEPENDENCY-CVE-CVE-2026-42036; SCAN-DEPENDENCY-CVE-CVE-2026-42037; SCAN-DEPENDENCY-CVE-CVE-2026-42038; SCAN-DEPENDENCY-CVE-CVE-2026-42039; SCAN-DEPENDENCY-CVE-CVE-2026-42041; +13 more
• Evidence: package-lock.json:3689; package-lock.json:5140; package-lock.json:6692; package-lock.json:6745; yarn.lock:1179; +3 more

SCA-003: Vulnerable dependencies require version upgrades: minimatch, flatted, next (110 findings)

• Severity: HIGH
• Confidence: 0.9
• Category: dependency_sca
• Affected paths: frontend/package-lock.json; frontend/yarn.lock
• What was found: Package 'minimatch@3.1.2' is vulnerable to 'CVE-2026-27904' (also known as 'GHSA-23c5-xmqv-rm74').
• Impact: A vulnerable dependency version is resolved at build or runtime, exposing the application to the documented CVE / advisory attack class.
• Recommendation: Upgrade the affected package to a fixed version or apply the vendor-recommended mitigation; pin transitive dependencies if needed.
• Proof required: Re-run the scan after the fix; verify the finding no longer reproduces and the redaction invariant holds.
• Rule metadata: SCAN-DEPENDENCY-CVE-CVE-2026-27904; SCAN-DEPENDENCY-CVE-CVE-2026-32141; SCAN-DEPENDENCY-CVE-CVE-2026-44575; SCAN-DEPENDENCY-CVE-CVE-2026-45109; SCAN-DEPENDENCY-CVE-CVE-2025-69873; SCAN-DEPENDENCY-CVE-CVE-2026-44494; SCAN-DEPENDENCY-CVE-CVE-2026-44573; SCAN-DEPENDENCY-CVE-CVE-2026-44495; +47 more
• Evidence: frontend/package-lock.json; frontend/yarn.lock

MEDIUM / LOW Findings

Excluded Adapter Candidates

Audit-only candidates dropped by Phase B or explicit exception policy. These rows do not contribute to Findings Ledger, severity finding sections, Recommended Actions, machine-readable findings, verdict, or blocking counts.

PASSED CHECKS

• Rules clean: adapter-backed categories with executed status and no surviving findings.
• Engines skipped: - sast: adapter-not-on-path
• supply_chain: no-deterministic-adapter-binding:security_scan_review:supply_chain
• Engines unavailable: - sast: adapter-not-on-path
• supply_chain: no-deterministic-adapter-binding:security_scan_review:supply_chain

Artifact Self-Check

• Template used: templates/security-scan-report.md (tier m)
• Required compact main sections covered (verbatim H2 headers): yes
• Issues That Matter Now is capped at top 5 and points extra findings to Appendix / summary.json / SARIF / evidence: yes
• Critical/high findings use readable titles and keep rule IDs as metadata: yes
• Excluded candidates are rendered only under Appendix ## Excluded Adapter Candidates, not under severity finding sections: yes
• Open Questions And Decision Needed includes recommended defaults and blocks next-step routing when unresolved blocking rows exist: yes
• Next Step routes implementation work to th-writing-plans instead of creating a second docs/security plan: yes
• Evidence gaps recorded under Trust Notes and summary.json rather than dropped: yes
• Checks run vs skipped reconciled with engine-manifest engines: yes
• Standards lenses applied section lists only lenses actually used and does not add a none row: yes
• Approval boundaries respected (no auto-rotation, no sample upload, no execution of suspicious artifacts): yes
• Redaction-before-write applied to raw adapter outputs, report content, SARIF, logs, and JSON summary: yes

Artifact: security_scan_review / security-scan-report / tier m - output is English-only by contract