--- engine_id: security_scan_review template_id: security-scan-report tier: m scan_id: 20260610-0841-scopelytics-deep-security-scan evidence_path: docs/security/evidence/20260610-0841-scopelytics-deep-security-scan severity_vocab_source: ../../shared/findings-common/severity-vocab.json --- # Security Scan Report: scopelytics-deep-security-scan ## Security Verdict - **Verdict:** FAIL - **Scan Mode:** deep - **Scope:** all - **Selection:** default - **Env file policy:** runtime env files excluded by default; shared/test env files remain in scope; this boundary is independent of git ignore handling - **Blocking issues:** 4 - **Highest severity:** critical - **Coverage confidence:** low - **Immediate next step:** Review skipped or unavailable engines before treating clean categories as passed. ## Issues That Matter Now Main body is capped at top 5 issue groups; full audit detail stays in Appendix / summary.json / SARIF / evidence. | ID | Issue | Why it matters | Where | Fix now | Status | | ---------- | ------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | ------ | | SCA-001 | Vulnerable dependencies require version upgrades: axios, next, xlsx | A vulnerable dependency version is resolved at build or runtime, exposing the application to the documented... | package-lock.json:3689; package-lock.json:6692; package-lock.json:8634; +3 more | Upgrade the affected package to a fixed version or apply the vendor-recommended mitigation; pin transitive... | new | | SECRET-001 | Hardcoded secrets or credentials are present in scanned files | Secret embedded in source recoverable from version control or distribution. | backend/.env.example:24; backend/.env.example:30; backend/scripts/run_bid_advisor_eval_dataset.py:16; +1 more | Rotate the credential, remove from history, and store in a secret manager. | new | | SCA-002 | Vulnerable dependencies require version upgrades: axios, follow-redirects, next | A vulnerable dependency version is resolved at build or runtime, exposing the application to the documented... | package-lock.json:3689; package-lock.json:5140; package-lock.json:6692; +5 more | Upgrade the affected package to a fixed version or apply the vendor-recommended mitigation; pin transitive... | new | | SCA-003 | Vulnerable dependencies require version upgrades: minimatch, flatted, next | A vulnerable dependency version is resolved at build or runtime, exposing the application to the documented... | frontend/package-lock.json; frontend/yarn.lock | Upgrade the affected package to a fixed version or apply the vendor-recommended mitigation; pin transitive... | new | | SCA-004 | Vulnerable dependencies require version upgrades: axios, next | A vulnerable dependency version is resolved at build or runtime, exposing the application to the documented... | package-lock.json:3689; package-lock.json:6692; yarn.lock:1179; +1 more | Upgrade the affected package to a fixed version or apply the vendor-recommended mitigation; pin transitive... | new | +1 more issue group(s) in Appendix / summary.json / SARIF / evidence. ## Trust Notes - sast: skipped; adapter-not-on-path - supply_chain: skipped; no-deterministic-adapter-binding:security_scan_review:supply_chain ## Next Step - **Next:** evidence-gap review - **Why:** Resolve material findings or missing adapter coverage before release-gate decisions. - **Default scope:** SCA-001, SECRET-001, SCA-002, SCA-003, SCA-004 - **Requires approval:** yes; invoke `th-writing-plans` before implementation work - **Proof gate:** Re-run this command or the agent-led `/th-security-scan` workflow after the implementation plan is executed. ## Evidence - `docs/security/evidence/20260610-0841-scopelytics-deep-security-scan/raw` - raw adapter outputs - `docs/security/evidence/20260610-0841-scopelytics-deep-security-scan/sarif/report.sarif` - machine-readable security findings - `docs/security/evidence/20260610-0841-scopelytics-deep-security-scan/logs/summary.json` - machine-readable summary for automation and audit - `docs/security/evidence/20260610-0841-scopelytics-deep-security-scan/logs` - runner logs and JSON summaries - `docs/security/evidence/20260610-0841-scopelytics-deep-security-scan/sbom` - SBOM evidence when generated by adapters - `docs/security/evidence/20260610-0841-scopelytics-deep-security-scan/hashes` - artifact hashes when malware_ioc adapters emit them ## Open Questions And Decision Needed | ID | Type | Question / Decision | Recommended Default | Impact If Default Used | Blocks Next Step | Status | | ---- | ---- | ------------------- | ------------------- | ---------------------- | ---------------- | -------- | | none | n/a | n/a | n/a | n/a | none | resolved | ## Appendix: Audit Detail Full detail is intentionally outside the main body. Use this section only when a reviewer needs raw traceability beyond the first-screen issue summary. Machine-readable summary data lives in `docs/security/evidence/20260610-0841-scopelytics-deep-security-scan/logs/summary.json`. ## Recommended Actions Do not create a second docs/security remediation-plan companion by default. | ID | Title | Recommendation | Proof Required | Next Step | | ---------- | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------- | ---------------- | | SCA-001 | Vulnerable dependencies require version upgrades: axios, next, xlsx | Upgrade the affected package to a fixed version or apply the vendor-recommended mitigation; pin transitive dependencies if needed. | Re-run the scan after the fix; verify the finding no longer reproduces and the redaction invariant holds. | th-writing-plans | | SECRET-001 | Hardcoded secrets or credentials are present in scanned files | Rotate the credential, remove from history, and store in a secret manager. | Re-run the scan after rotation; verify the redaction invariant. | th-writing-plans | | SCA-002 | Vulnerable dependencies require version upgrades: axios, follow-redirects, next | Upgrade the affected package to a fixed version or apply the vendor-recommended mitigation; pin transitive dependencies if needed. | Re-run the scan after the fix; verify the finding no longer reproduces and the redaction invariant holds. | th-writing-plans | | SCA-003 | Vulnerable dependencies require version upgrades: minimatch, flatted, next | Upgrade the affected package to a fixed version or apply the vendor-recommended mitigation; pin transitive dependencies if needed. | Re-run the scan after the fix; verify the finding no longer reproduces and the redaction invariant holds. | th-writing-plans | | SCA-004 | Vulnerable dependencies require version upgrades: axios, next | Upgrade the affected package to a fixed version or apply the vendor-recommended mitigation; pin transitive dependencies if needed. | Re-run the scan after the fix; verify the finding no longer reproduces and the redaction invariant holds. | inline | | IAC-001 | Container image is missing a health check | Apply the concept rule's remediation: tighten the affected directive, drop unneeded capabilities, or replace the insecure default per the rule's help. | Re-run the scan after the fix; verify the finding no longer reproduces and the redaction invariant holds. | inline | ## JSON Summary ```json { "scan_id": "20260610-0841-scopelytics-deep-security-scan", "verdict": "FAIL", "scan_mode": "deep", "scope": "all", "selection": "default", "include_runtime_env_files": false, "env_file_policy": { "default_include_runtime_env_files": false, "include_runtime_env_files": false, "path_pattern": ".env*", "default_included_shared_test_filenames": [ ".env.example", ".env.sample", ".env.template", ".env.test" ], "runtime_env_classification_rules": [ "Any .env* path not explicitly listed under default_included_shared_test_filenames is treated as a runtime env file by default.", "Local runtime variants remain runtime env files even when they contain test-like labels, for example .env.test.local.", "Explicit path scopes such as artifact_path= or malware_path= may still target a runtime env file intentionally; the default exclusion applies to curated/default scan surface resolution, not to explicit path targeting." ], "default_policy_summary": "Runtime env files are excluded from the default scan surface, including scope=all and scan_mode=deep. Shared/test env files remain in scope by default. This boundary is independent of git ignore handling.", "classification_owner_note": "Use this block as the single owner for env-file classification, default inclusion, and metadata wording.", "metadata_requirements": { "resolved_fields": [ "include_runtime_env_files", "env_file_policy" ], "required_wording": "Report whether runtime env files were excluded by default or explicitly included, and distinguish that decision from git ignore handling and from shared/test env files that remain in scope." } }, "confidence_threshold": 0.8, "counts": { "critical": 46, "high": 152, "medium": 9, "low": 0 }, "excluded_counts": { "critical": 0, "high": 0, "medium": 0, "low": 0 }, "engines": { "secrets": { "status": "executed", "scanner": "gitleaks", "reason": "n/a" }, "sast": { "status": "skipped", "scanner": "unavailable", "reason": "adapter-not-on-path" }, "dependency_sca": { "status": "executed", "scanner": "osv_scanner,trivy", "reason": "n/a" }, "iac_container": { "status": "executed", "scanner": "trivy", "reason": "n/a" }, "supply_chain": { "status": "skipped", "scanner": "reasoning", "reason": "no-deterministic-adapter-binding:security_scan_review:supply_chain" }, "malware_ioc": { "status": "executed", "scanner": "clamav,yara", "reason": "n/a" } }, "per_category_verdict": { "secrets": "FAIL", "dependency_sca": "FAIL", "iac_container": "WARN", "sast": "NEEDS_REVIEW", "supply_chain": "NEEDS_REVIEW", "malware_ioc": "PASS" }, "engine": "security_scan_review", "auto_install_adapters": true, "install_ledger_path": "docs/security/evidence/20260610-0841-scopelytics-deep-security-scan/logs/adapter-install-ledger.json", "adapter_install_ledger": { "path": "docs/security/evidence/20260610-0841-scopelytics-deep-security-scan/logs/adapter-install-ledger.json", "install_ledger_path": "docs/security/evidence/20260610-0841-scopelytics-deep-security-scan/logs/adapter-install-ledger.json", "installer_invoked": true, "selected_tools": [ "semgrep" ], "skipped_tools": [], "missing_tools": [ "semgrep" ], "no_project_dependency_install": true, "no_download": true, "no_package_manager_operation": true }, "sbom": { "sbom_generator": null, "sbom_generation_status": "not_generated", "sbom_fallback_reason": "no-sbom-capable-adapter-produced-output", "sbom_completeness": "unknown", "sbom_paths": [], "sbom_formats": [] }, "sbom_generator": null, "sbom_generation_status": "not_generated", "sbom_fallback_reason": "no-sbom-capable-adapter-produced-output", "sbom_completeness": "unknown" } ``` This summary lets agents and tools quickly verify verdict, counts, engines, scope, selection, env-file policy, and blocking decision state without parsing the prose sections. ## Security Context - **Project type (concept-level):** CI/CD configured - **Sensitive areas:** env-file presence=False - **Scan limitations:** deterministic runner is adapter-backed; agent reasoning-only coverage is surfaced as skipped when no local adapter ran. - **Path display policy:** finding paths are rendered source-relative when adapters scan a temporary source-only mirror or explicit target under the repository. - **Env-file policy detail:** Runtime env files are excluded from the default scan surface, including scope=all and scan_mode=deep. Shared/test env files remain in scope by default. This boundary is independent of git ignore handling. - **Resolved env-file metadata:** `include_runtime_env_files=False` with `env_file_policy` embedded in the JSON summary for auditability. - **Machine-readable summary:** `docs/security/evidence/20260610-0841-scopelytics-deep-security-scan/logs/summary.json` ## Engines Executed | Engine | Status | Scanner | | ------------------------------- | -------- | ----------------- | | security_context_discovery | executed | reasoning | | secrets | executed | gitleaks | | sast | skipped | unavailable | | dependency_sca | executed | osv_scanner,trivy | | iac_container | executed | trivy | | supply_chain | skipped | reasoning | | malware_ioc | executed | clamav,yara | | risk_prioritization_remediation | executed | reasoning | ## Standards Lenses Applied | Lens | Source | Applied To | Evidence / Use | | ----------------- | --------------------------- | ----------------------- | ----------------------------------------------------------------------------------------------------------------------- | | CVSS | rules/standards-lenses.json | dependency_sca findings | Applied when upstream advisory severity or CVSS metadata materially informed severity or prioritization. | | EPSS | rules/standards-lenses.json | dependency_sca findings | Applied when exploit-likelihood signals materially affected remediation priority for surviving dependency findings. | | CISA KEV | rules/standards-lenses.json | dependency_sca findings | Applied when active-exploitation status materially raised urgency for a surviving dependency finding. | | Trivy | rules/standards-lenses.json | dependency_sca findings | Trivy advisory metadata informed dependency vulnerability evidence and scanner traceability. | | OSV / OSV-Scanner | rules/standards-lenses.json | dependency_sca findings | OSV advisory identifiers and affected package ranges informed dependency vulnerability evidence. | | CIS Benchmarks | inherited architect lens | iac_container findings | Infrastructure and container hardening expectations informed remediation guidance for surviving configuration findings. | ## Findings Ledger | ID | Title | Severity | Confidence | Category | Count | Paths | Recommendation | Status | | ---------- | ------------------------------------------------------------------------------- | -------- | ---------- | -------------- | ----- | ------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- | ------ | | SCA-001 | Vulnerable dependencies require version upgrades: axios, next, xlsx | critical | 0.9 | dependency_sca | 42 | package-lock.json:3689; package-lock.json:6692; package-lock.json:8634; +3 more | Upgrade the affected package to a fixed version or apply the vendor-recommended mitigation; pin transitive... | new | | SECRET-001 | Hardcoded secrets or credentials are present in scanned files | critical | 0.9 | secrets | 4 | backend/.env.example:24; backend/.env.example:30; backend/scripts/run_bid_advisor_eval_dataset.py:16; +1 more | Rotate the credential, remove from history, and store in a secret manager. | new | | SCA-002 | Vulnerable dependencies require version upgrades: axios, follow-redirects, next | high | 0.9 | dependency_sca | 42 | package-lock.json:3689; package-lock.json:5140; package-lock.json:6692; +5 more | Upgrade the affected package to a fixed version or apply the vendor-recommended mitigation; pin transitive... | new | | SCA-003 | Vulnerable dependencies require version upgrades: minimatch, flatted, next | high | 0.9 | dependency_sca | 110 | frontend/package-lock.json; frontend/yarn.lock | Upgrade the affected package to a fixed version or apply the vendor-recommended mitigation; pin transitive... | new | | SCA-004 | Vulnerable dependencies require version upgrades: axios, next | medium | 0.9 | dependency_sca | 8 | package-lock.json:3689; package-lock.json:6692; yarn.lock:1179; +1 more | Upgrade the affected package to a fixed version or apply the vendor-recommended mitigation; pin transitive... | new | | IAC-001 | Container image is missing a health check | medium | 0.9 | iac_container | 1 | Dockerfile:1 | Apply the concept rule's remediation: tighten the affected directive, drop unneeded capabilities, or replac... | new | ## CRITICAL Findings ### SCA-001: Vulnerable dependencies require version upgrades: axios, next, xlsx (42 findings) - Severity: CRITICAL - Confidence: 0.9 - Category: dependency_sca - Affected paths: `package-lock.json:3689; package-lock.json:6692; package-lock.json:8634; yarn.lock:1179; yarn.lock:2719; +1 more` - What was found: Package: axios Installed Version: 1.13.5 Vulnerability CVE-2026-42033 Severity: HIGH Fixed Version: 1.15.1, 0.31.1 Link: [CVE-2026-42033](https://avd.aquasec.com/nvd/cve-2026-42033) - Exploit scenario: A vulnerable dependency version is resolved at build or runtime, exposing the application to the documented CVE / advisory attack class. - Recommendation: Upgrade the affected package to a fixed version or apply the vendor-recommended mitigation; pin transitive dependencies if needed. - Proof required: Re-run the scan after the fix; verify the finding no longer reproduces and the redaction invariant holds. - Rule metadata: SCAN-DEPENDENCY-CVE-CVE-2026-42033; SCAN-DEPENDENCY-CVE-CVE-2026-42035; SCAN-DEPENDENCY-CVE-CVE-2026-42043; SCAN-DEPENDENCY-CVE-CVE-2026-42264; SCAN-DEPENDENCY-CVE-CVE-2026-44486; SCAN-DEPENDENCY-CVE-CVE-2026-44487; SCAN-DEPENDENCY-CVE-CVE-2026-44488; SCAN-DEPENDENCY-CVE-CVE-2026-44492; +13 more - Evidence: `package-lock.json:3689; package-lock.json:6692; package-lock.json:8634; yarn.lock:1179; yarn.lock:2719; +1 more` ### SECRET-001: Hardcoded secrets or credentials are present in scanned files (4 findings) - Severity: CRITICAL - Confidence: 0.9 - Category: secrets - Affected paths: `backend/.env.example:24; backend/.env.example:30; backend/scripts/run_bid_advisor_eval_dataset.py:16; backend/tests/conftest.py:15` - What was found: Gitleaks generic secret detector matched credential-like high-entropy text in C:[REDACTED:SCAN-HARDCODED-SECRET]-security-scan-filtered-8hmtelnh/secrets/001/backend/.env.example (scanner rule: generic-api-key). - Exploit scenario: Secret embedded in source recoverable from version control or distribution. - Recommendation: Rotate the credential, remove from history, and store in a secret manager. - Proof required: Re-run the scan after rotation; verify the redaction invariant. - Rule metadata: SCAN-HARDCODED-SECRET - Scanner Rule ID(s): generic-api-key - Evidence: `backend/.env.example:24; backend/.env.example:30; backend/scripts/run_bid_advisor_eval_dataset.py:16; backend/tests/conftest.py:15` ## HIGH Findings ### SCA-002: Vulnerable dependencies require version upgrades: axios, follow-redirects, next (42 findings) - Severity: HIGH - Confidence: 0.9 - Category: dependency_sca - Affected paths: `package-lock.json:3689; package-lock.json:5140; package-lock.json:6692; package-lock.json:6745; yarn.lock:1179; +3 more` - What was found: Package: axios Installed Version: 1.13.5 Vulnerability CVE-2025-62718 Severity: MEDIUM Fixed Version: 1.15.0, 0.31.0 Link: [CVE-2025-62718](https://avd.aquasec.com/nvd/cve-2025-62718) - Impact: A vulnerable dependency version is resolved at build or runtime, exposing the application to the documented CVE / advisory attack class. - Recommendation: Upgrade the affected package to a fixed version or apply the vendor-recommended mitigation; pin transitive dependencies if needed. - Proof required: Re-run the scan after the fix; verify the finding no longer reproduces and the redaction invariant holds. - Rule metadata: SCAN-DEPENDENCY-CVE-CVE-2025-62718; SCAN-DEPENDENCY-CVE-CVE-2026-40175; SCAN-DEPENDENCY-CVE-CVE-2026-42034; SCAN-DEPENDENCY-CVE-CVE-2026-42036; SCAN-DEPENDENCY-CVE-CVE-2026-42037; SCAN-DEPENDENCY-CVE-CVE-2026-42038; SCAN-DEPENDENCY-CVE-CVE-2026-42039; SCAN-DEPENDENCY-CVE-CVE-2026-42041; +13 more - Evidence: `package-lock.json:3689; package-lock.json:5140; package-lock.json:6692; package-lock.json:6745; yarn.lock:1179; +3 more` ### SCA-003: Vulnerable dependencies require version upgrades: minimatch, flatted, next (110 findings) - Severity: HIGH - Confidence: 0.9 - Category: dependency_sca - Affected paths: `frontend/package-lock.json; frontend/yarn.lock` - What was found: Package 'minimatch@3.1.2' is vulnerable to 'CVE-2026-27904' (also known as 'GHSA-23c5-xmqv-rm74'). - Impact: A vulnerable dependency version is resolved at build or runtime, exposing the application to the documented CVE / advisory attack class. - Recommendation: Upgrade the affected package to a fixed version or apply the vendor-recommended mitigation; pin transitive dependencies if needed. - Proof required: Re-run the scan after the fix; verify the finding no longer reproduces and the redaction invariant holds. - Rule metadata: SCAN-DEPENDENCY-CVE-CVE-2026-27904; SCAN-DEPENDENCY-CVE-CVE-2026-32141; SCAN-DEPENDENCY-CVE-CVE-2026-44575; SCAN-DEPENDENCY-CVE-CVE-2026-45109; SCAN-DEPENDENCY-CVE-CVE-2025-69873; SCAN-DEPENDENCY-CVE-CVE-2026-44494; SCAN-DEPENDENCY-CVE-CVE-2026-44573; SCAN-DEPENDENCY-CVE-CVE-2026-44495; +47 more - Evidence: `frontend/package-lock.json; frontend/yarn.lock` ## MEDIUM / LOW Findings | ID | Title | Severity | Count | Paths | Recommendation | | ------- | ------------------------------------------------------------- | -------- | ----- | ------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------ | | SCA-004 | Vulnerable dependencies require version upgrades: axios, next | medium | 8 | package-lock.json:3689; package-lock.json:6692; yarn.lock:1179; yarn.lock:2719 | Upgrade the affected package to a fixed version or apply the vendor-recommended mitigation; pin transitive dependencies if needed. | | IAC-001 | Container image is missing a health check | medium | 1 | Dockerfile:1 | Apply the concept rule's remediation: tighten the affected directive, drop unneeded capabilities, or replace the insecure default per the rule's help. | ## Excluded Adapter Candidates Audit-only candidates dropped by Phase B or explicit exception policy. These rows do not contribute to Findings Ledger, severity finding sections, Recommended Actions, machine-readable findings, verdict, or blocking counts. | ID | Severity | Status | Category | Paths | Reason | | ---- | -------- | ------ | -------- | ----- | ------ | | none | n/a | n/a | n/a | n/a | n/a | ## PASSED CHECKS - **Rules clean:** adapter-backed categories with executed status and no surviving findings. - **Engines skipped:** - sast: adapter-not-on-path - supply_chain: no-deterministic-adapter-binding:security_scan_review:supply_chain - **Engines unavailable:** - sast: adapter-not-on-path - supply_chain: no-deterministic-adapter-binding:security_scan_review:supply_chain ## Artifact Self-Check - Template used: `templates/security-scan-report.md` (tier `m`) - Required compact main sections covered (verbatim H2 headers): yes - Issues That Matter Now is capped at top 5 and points extra findings to Appendix / summary.json / SARIF / evidence: yes - Critical/high findings use readable titles and keep rule IDs as metadata: yes - Excluded candidates are rendered only under Appendix `## Excluded Adapter Candidates`, not under severity finding sections: yes - Open Questions And Decision Needed includes recommended defaults and blocks next-step routing when unresolved blocking rows exist: yes - Next Step routes implementation work to th-writing-plans instead of creating a second docs/security plan: yes - Evidence gaps recorded under Trust Notes and `summary.json` rather than dropped: yes - Checks run vs skipped reconciled with engine-manifest engines: yes - Standards lenses applied section lists only lenses actually used and does not add a `none` row: yes - Approval boundaries respected (no auto-rotation, no sample upload, no execution of suspicious artifacts): yes - Redaction-before-write applied to raw adapter outputs, report content, SARIF, logs, and JSON summary: yes --- *Artifact: `security_scan_review / security-scan-report / tier m` - output is English-only by contract*