# llm-sast-scanner harvest inventory — breadth cross-check + KB signals

audience: AI coding agents first. BLUF-ordered, imperative. READ-ONLY harvest wave — inventory + recommendations ONLY; no donor text copied.

**Donor:** SunWeb3Sec/llm-sast-scanner (MIT, attribute on harvest). Path: `/home/user/Projects/security-gate/tmp/llm-sast-scanner/llm-sast-scanner/`.  
**SoT:** taxonomy `docs/taxonomy/security.md` · doctrine `CLAUDE.md` · band-1 prompt `domains/security/detectors/baseline/baseline.prompt.txt`.

---

## Part 1 — breadth cross-check (34 classes → S1–S11)

| their class | mapping | notes |
|-------------|---------|-------|
| arbitrary_file_upload | BLIND-SPOT-CANDIDATE | Upload sinks (extension/MIME bypass, webroot placement) have no S#; baseline Pass 4 mentions upload confusion only in passing. |
| authentication_jwt | COVERED (S1 auth/session/token lifecycle) | JWT alg confusion, claim gaps, refresh reuse = token-lifecycle defects; S10 covers OAuth-code replay specifically. |
| brute_force | BLIND-SPOT-CANDIDATE | Missing rate limit / lockout on login, OTP, reset — no S#; matters when Astro cookie-session routes lack throttling. |
| business_logic | BLIND-SPOT-CANDIDATE | Domain-invariant abuse (pricing, quotas, workflow skip) broader than S9 self-deal; TS payment repos expose client-trusted totals and discount edges. |
| csrf | BLIND-SPOT-CANDIDATE | Cookie-ambient state change without anti-CSRF token; Bearer-only APIs less exposed, but session-cookie checkout/admin flows in TS stacks are. |
| cve_patterns | COVERED (S11 dependencies/CVE) | Sink-pattern heuristics overlap S11 band-3 `pnpm audit` leg; headers leg is separate. |
| default_credentials | BLIND-SPOT-CANDIDATE | Hardcoded admin/API creds in source — baseline Pass 8 flags secrets but no measured S# cell targets this shape. |
| denial_of_service | BLIND-SPOT-CANDIDATE | ReDoS, unbounded allocation, XML/zip bombs — baseline Pass 9 partial; no S# bench class. |
| expression_language_injection | BLIND-SPOT-CANDIDATE | SpEL/OGNL/MVEL eval sinks — Java-centric; low incidence in TS/JS Workers stack. |
| graphql_injection | BLIND-SPOT-CANDIDATE | Introspection, depth/complexity, resolver SQLi — distinct from S4 Drizzle SQLi cells. |
| http_method_tamper | BLIND-SPOT-CANDIDATE | GET/override bypassing method-scoped auth — not subsumed by S2 RBAC cells (role check ≠ method guard). |
| idor | COVERED (S3 tenant isolation, S8 cross-tenant IDOR) | Horizontal/vertical BOLA; S3 n=3 + S8 cell cover object-reference authorization in our corpus. |
| information_disclosure | BLIND-SPOT-CANDIDATE | Debug endpoints, verbose errors, metadata in responses — baseline Pass 8 partial; no dedicated S#. |
| insecure_cookie | BLIND-SPOT-CANDIDATE | Missing Secure/HttpOnly/SameSite on session cookies — adjacent to S1 but no S1 cell measures flag defects. |
| insecure_deserialization | BLIND-SPOT-CANDIDATE | Untrusted object reconstruction (Java gadgets, unsafe JSON polymorphism) — rare in Drizzle/Postgres TS services but YAML/config parse paths exist. |
| jndi_injection | BLIND-SPOT-CANDIDATE | JNDI lookup → RCE — Java-only; not a live TS/JS payment-repo threat. |
| mobile_security | OUT-OF-SCOPE | Android/iOS — not our TS/JS/Workers target stack. |
| nosql_injection | BLIND-SPOT-CANDIDATE | Mongo operator injection — we anchor on Postgres; still relevant if a service uses Mongo alongside payments. |
| open_redirect | BLIND-SPOT-CANDIDATE | Unvalidated `next`/`return`/`redirect` params — OAuth/login flows in TS apps; S10 covers code replay, not redirect target validation. |
| path_traversal_lfi_rfi | BLIND-SPOT-CANDIDATE | `../` in file read/write — baseline Pass 4 mentions traversal; no S# cell (S6 is outbound SSRF, not local path). |
| php_security | OUT-OF-SCOPE | PHP-specific — not our stack. |
| privilege_escalation | COVERED (S2 RBAC/authorization) | Self-assigned role, missing admin guard — S2 measured n=3. |
| race_conditions | BLIND-SPOT-CANDIDATE | TOCTOU, double-spend, parallel idempotency bypass — baseline Pass 5 signals but no bench class; high impact on payment retries/webhooks. |
| rce | BLIND-SPOT-CANDIDATE | Command injection, `eval`, unsafe `child_process` — no S#; Workers reduce shell-RCE but `eval`/Function still possible. |
| session_fixation | COVERED (S1 auth/session/token lifecycle) | Session ID not rotated on auth upgrade — subset of session lifecycle; baseline Pass 2 covers session integrity. |
| smuggling_desync | BLIND-SPOT-CANDIDATE | CL/TE desync at proxy/backend — Cloudflare Workers sit behind proxies; cache-poisoning class absent from S1–S11. |
| sql_injection | COVERED (S4 SQLi) | Parameterized-query / raw-interpolation defects — S4 cell `9b0c485`. |
| ssrf | COVERED (S6 SSRF) | User-controlled outbound fetch — S6 cell `bec8bc8`. |
| ssti | BLIND-SPOT-CANDIDATE | User input controls template *string* (not just vars) — distinct from S5 output-encoding/XSS in HTML/email contexts. |
| trust_boundary | BLIND-SPOT-CANDIDATE | Donor narrows to CWE-501 session-attribute pollution; baseline names trust boundary broadly but no S# for request→session role injection. |
| verification_code_abuse | BLIND-SPOT-CANDIDATE | Predictable OTP, missing attempt limits, code echoed in response — overlaps S1 reset-token discipline but distinct from S10 OAuth replay. |
| weak_crypto_hash | BLIND-SPOT-CANDIDATE | MD5/SHA1 passwords, `Math.random` tokens — baseline Pass 8 partial; no S# owns crypto-weakness class (S7 is webhook HMAC fail-open only). |
| xss | COVERED (S5 output-encoding/XSS) | Stored/reflected/DOM XSS — S5 cell `a15deb0`. |
| xxe | BLIND-SPOT-CANDIDATE | XML external entities — uncommon in TS stack; relevant if integrations parse XML webhooks. |

### BLIND-SPOT-CANDIDATE short-list (promote to bench only after git-pinned cell)

Ranked highest first:

1. **race_conditions** — payment webhooks and idempotent retries in TS/Workers are concurrency-native; double-effect is direct money loss.
2. **business_logic** — client-trusted totals, negative amounts, workflow skip outside S9 self-deal oracle boundary.
3. **csrf** — cookie-session Astro admin/checkout routes without CSRF tokens remain exploitable in browser context.
4. **open_redirect** — login/OAuth `returnUrl` abuse chains into token theft or phishing in payment onboarding.
5. **verification_code_abuse** — SMS/email OTP and 2FA endpoints without rate limits in fintech signup flows.
6. **path_traversal_lfi_rfi** — attachment/download handlers in TS services if path segments are user-influenced.
7. **arbitrary_file_upload** — avatar/invoice upload surfaces that land under servable paths.
8. **insecure_deserialization** — unsafe YAML/JSON polymorphic parse of webhook or import payloads.
9. **brute_force** — credential stuffing on login before rate limits propagate to edge.
10. **smuggling_desync** — desync at CDN→Worker boundary when custom origin parsing diverges.

---

## Part 2 — KB content inventory (band-1 prompt signal gap)

Six highest-value KBs for TS/JS payment reality. Signals paraphrased; donor text not copied.

| KB filename | detection signal / heuristic (paraphrase) | baseline.prompt.txt already covers? | recommendation |
|-------------|---------------------------------------------|--------------------------------------|----------------|
| `business_logic.md` | Map workflow state machines; flag client-supplied prices/totals, skipped preconditions, discount stacking, negative/zero amounts, idempotency key scoped to path not principal. | partial — Pass 5–6 cover idempotency/state transitions; no client-total or discount-invariant hunt | fold-a-paraphrased-line-into-baseline-prompt (server must recompute money fields; reject negative amounts) |
| `race_conditions.md` | Hunt read-modify-write without transaction/lock; parallel identical requests defeating check-then-act; idempotency store written after side effect; duplicate webhook/job fulfillment. | partial — Pass 5 names TOCTOU/idempotency; lacks explicit “duplicate parallel request” trigger | promote-to-new-bench-class **only after** git-pinned payment/idempotency fix cell harvested |
| `idor.md` | Every client object id must bind to caller tenant/owner on every transport; flag `findById` without ownership predicate, batch endpoints validating first element only, GraphQL resolver re-auth gaps. | yes — Pass 3 + Pass 7 tenant/owner predicates mirror this | skip — baseline already encodes; corpus S3/S8 is the measured leg |
| `ssrf.md` | User input reaching outbound HTTP client URL/host; denylist bypass via IP encodings, redirects, `file://`; cloud metadata hosts. | yes — Pass 4 SSRF allowlist + internal/metadata block | skip — S6 cell exists |
| `authentication_jwt.md` | Algorithm confusion (`none`/RS256→HS256), unverified `jwt.decode` for authz, missing iss/aud/azp, refresh reuse without rotation, kid/jku header key injection. | partial — Pass 2 OAuth/state/PKCE; Pass 8 signature/HMAC; shallow on JWT header abuse | fold-a-paraphrased-line-into-baseline-prompt (pin algorithms; never authz from unverified decode) |
| `weak_crypto_hash.md` | Presence-based: MD5/SHA1 for passwords, `Math.random` for tokens/OTP, non-constant-time secret compare. | partial — Pass 8 lists timing oracle + weak random; no explicit banned-algo checklist | fold-a-paraphrased-line-into-baseline-prompt (ban MD5/SHA1/Math.random on security paths) |
| `trust_boundary.md` | Request params/headers written into server session or trusted role store without server-side validation (CWE-501 servlet pattern). | no — baseline assumes trust boundary at file edge, not session-attribute pollution from client fields | skip for now — servlet-centric; revisit if TS session stores accept client role fields |

---

## Part 3 — money-depth gap check (S9 edge)

**BLUF:** Their `business_logic.md` is **wider but shallower** on payments than our S9 + band-3 oracle. S9 money-depth is **genuinely our differentiator** for complete-mediation self-deal; donor KB does not replace the oracle.

| S9 depth axis | our coverage | donor `business_logic.md` (+ payment-adjacent KBs) |
|---------------|--------------|--------------------------------------------------|
| Complete-mediation self-deal (actor must not be beneficiary/recipient on same money move) | S9 band-3 oracle — field-name lexicon + asymmetry pipeline; held-out generalization measured | Mentions payments/refunds/idempotency generically; **no** self-deal / beneficiary-equals-actor invariant |
| Fail-open HMAC / signature compare | S7 cell (`5a2867f`) + baseline Pass 8 raw-body HMAC | Not in business_logic; authentication_jwt covers JWT not webhook timing-safe compare |
| Payment atomicity (check-then-capture in one transaction) | Baseline Pass 5 + S9 context | race_conditions KB names double-spend pattern but **no** capture/refund sequence invariants tied to mediation |
| Idempotency key scope (principal-bound, persisted) | Baseline Pass 5 + business_logic concurrency section | **Partial overlap** — donor notes key scoped to path not user; same signal, not deeper |
| Negative-amount / credit abuse | S9 oracle + finance depth | business_logic lists negative amounts as numeric abuse — **awareness only**, no complete-mediation linkage |
| Client-computed totals accepted server-side | Baseline Pass 5 implicit; finance prompt deeper | business_logic static heuristic #4 flags client `total` — **closest donor match**, still generic not self-deal |

**Verdict:** Donor catalogs fintech workflows (auth/capture/refund, credits, subscriptions) as *recon targets* but lacks our **deterministic self-deal asymmetry** and **fail-open webhook compare** cells. Paraphrase-worthy payment *prompt lines* exist; **S9 measured edge stays ours**.

---

## Part 4 — harvest verdict

- **Harvest (attributed, paraphrase-only):** Judge-step false-positive guardrails from donor `SKILL.md` (Bearer-only CSRF skip, protocol-designed SSRF skip, idempotent-signed replay skip) — fold concepts into orchestrator judging notes, not verbatim copy. Payment-adjacent **paraphrased one-liners** for baseline Pass 5/8 (client totals, negative amounts, JWT alg pin) — prompt wave separate from this inventory.
- **SKIP:** All 34 `references/*.md` bodies as inline prompt cargo — baseline already covers IDOR/SSRF/SQLi/XSS; Java-centric rules (JNDI, SpEL, servlet trust_boundary) misfire on TS/Workers. Do not import donor workflow as a band-2 sub-prompt without delete-test proof.
- **SKIP:** New bench taxonomy classes without git-pinned cells — synthesis forbidden (doctrine §Non-negotiable validation discipline).
- **SKIP:** `mobile_security`, `php_security` — out of stack.
- **Highest-value next action:** **Corpus harvest** — mine user's TS payment repos for a **race_conditions / idempotency** fix commit (double webhook fulfillment or parallel capture) before any bench promotion; donor KB informs what to grep for, not what to measure.

**Pointers:** delete-test `docs/ARCHITECTURE.md` §4 · no-false-clean · harvest skill `skills/harvest/SKILL.md`.