soldier0x0/briefr

Why those were dismissed

Two keys had to turn. The model had to name a reason from a fixed list of six, and a deterministic check of ours — over which files this artifact actually installs — had to independently agree. Anything it could not corroborate is in “not reviewed” above, at full severity.

• 92 Test or fixture file — The match is in a test or fixture. Our own check confirmed the file is not part of what gets installed.

  Rules: YARA_sql_injection_generic, DATA_EXFIL_JS_FS_ACCESS, AAK-SECRET-004 and 7 more · Files: /repo/backend/tests/test_embeddings_pgvector_e1.py, /repo/backend/tests/test_otx_pulse_iocs_phase_a.py, /repo/backend/tests/test_schema_split_migration.py and 52 more · reported by cisco-skill-scanner, agent-audit-kit

• 52 Documentation or example — The match is in documentation or sample code, confirmed by our own check to be outside the installed artifact.

  Rules: opt.nerlo-rules.nerlo-install-pipe-to-shell, PIPELINE_TAINT_FLOW, AAK-HEALTHCARE-AI-004 and 5 more · Files: /repo/docs/ONBOARDING.md, /repo/docs/OPERATIONS.md, /repo/docs/POSTGRES.md and 15 more · reported by nerlo-install-instruction, cisco-skill-scanner, agent-audit-kit

• 1 Agent instruction file — The match is in a file that instructs an AI coding agent — a CLAUDE.md or similar. It is documentation of intent, and our own check confirmed it is not part of what gets installed.

  Rules: TOOL_ABUSE_UNDECLARED_NETWORK · Files: /repo/repo/AGENTS.md · reported by cisco-skill-scanner

In installed code — never dismissed

These findings are in files this artifact installs and are not placeholder values. No false-positive basis can be corroborated for such a finding, so this review never dismisses one; they were not sent to the model and stand at their scanner's severity.

• 85 YARA_sql_injection_generic

  Files: /repo/backend/alembic/versions/003_users_email_to_username.py, /repo/backend/alembic/versions/036_intel_app_schema_split.py, /repo/backend/db/schema_split.py and 13 more · reported by cisco-skill-scanner

• 30 AAK-IPI-WILD-CORPUS-001

  Files: backend/db/init.py, backend/alembic/versions/010_detection_backlog.py, backend/alembic/versions/039_ti_mirror_threatfox_swap.py and 27 more · reported by agent-audit-kit

• 22 AAK-SECRET-004

  Files: backend/scheduler.py, scripts/postgres-dev.sh, deploy/briefr-restore.sh and 16 more · reported by agent-audit-kit

• 16 DATA_EXFIL_JS_NETWORK

  Files: /repo/frontend/src/api.js, /repo/frontend/src/utils/notificationsApi.js, /repo/scripts/capture_readme_screenshots.mjs · reported by cisco-skill-scanner

• 13 SQL_INJECTION_STRING_FORMAT

  Files: /repo/backend/detection/class_queries.py, /repo/backend/db/enrichment.py, /repo/backend/db/ai_operations.py and 6 more

Upheld — the review declined to dismiss these

The model could have called any of these a false positive and did not.

• 5 SQL_INJECTION_STRING_FORMAT

  Files: /repo/backend/feeds/extended.py, /repo/backend/db/metadata.py, /repo/backend/db/cve.py and 1 more · reported by cisco-skill-scanner

Not reviewed

• 23 The model called these false positives and our own check did not agree, so the dismissal was refused.

  Rules: SECRET_CONNECTION_STRING · Files: /repo/backend/tests/test_admin_intel_snapshot_import.py, /repo/backend/tests/test_backup_postgres.py, /repo/docs/OPERATIONS.md and 3 more · reported by cisco-skill-scanner

• 2 The model did not answer for these findings.

  Rules: DATA_EXFIL_NETWORK_REQUESTS · Files: /repo/backend/tests/conftest.py · reported by cisco-skill-scanner