{ "verifications": [ { "context_sources": [ "evidence_level", "finding_id", "function_name", "line", "path", "reachability_conditions", "reachability_evidence", "reachability_status", "severity", "tags", "title" ], "counter_case": "No function-level attacker-reachable entry point currently reaches this line.", "evidence_level": "static_corroboration", "finding_id": "python-flask-debug:app.py:81", "pro_case": "A static pattern matched the source line.", "required_next_step": "Add reachability evidence before prioritizing a fix.", "status": "rejected", "tie_breaker": "Provide call-graph, route, CLI, parser, or dynamic evidence linking attacker input to this function.", "verified": false }, { "context_sources": [ "evidence_level", "finding_id", "function_name", "line", "path", "reachability_conditions", "reachability_evidence", "reachability_status", "severity", "tags", "title" ], "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", "evidence_level": "static_corroboration", "finding_id": "python-os-command:app.py:17", "pro_case": "Static corroboration exists and function-level reachability evidence is attached.", "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.", "status": "accepted", "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.", "verified": true }, { "context_sources": [ "evidence_level", "finding_id", "function_name", "line", "path", "reachability_conditions", "reachability_evidence", "reachability_status", "severity", "tags", "title" ], "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", "evidence_level": "static_corroboration", "finding_id": "python-path-traversal:app.py:55", "pro_case": "Static corroboration exists and function-level reachability evidence is attached.", "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.", "status": "accepted", "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.", "verified": true }, { "context_sources": [ "evidence_level", "finding_id", "function_name", "line", "path", "reachability_conditions", "reachability_evidence", "reachability_status", "severity", "tags", "title" ], "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", "evidence_level": "static_corroboration", "finding_id": "python-shell-true:app.py:23", "pro_case": "Static corroboration exists and function-level reachability evidence is attached.", "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.", "status": "accepted", "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.", "verified": true }, { "context_sources": [ "evidence_level", "finding_id", "function_name", "line", "path", "reachability_conditions", "reachability_evidence", "reachability_status", "severity", "tags", "title" ], "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", "evidence_level": "static_corroboration", "finding_id": "python-sql-injection:app.py:44", "pro_case": "Static corroboration exists and function-level reachability evidence is attached.", "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.", "status": "accepted", "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.", "verified": true }, { "context_sources": [ "evidence_level", "finding_id", "function_name", "line", "path", "reachability_conditions", "reachability_evidence", "reachability_status", "severity", "tags", "title" ], "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", "evidence_level": "static_corroboration", "finding_id": "python-sql-injection:app.py:50", "pro_case": "Static corroboration exists and function-level reachability evidence is attached.", "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.", "status": "accepted", "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.", "verified": true }, { "context_sources": [ "evidence_level", "finding_id", "function_name", "line", "path", "reachability_conditions", "reachability_evidence", "reachability_status", "severity", "tags", "title" ], "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", "evidence_level": "static_corroboration", "finding_id": "python-ssrf:app.py:60", "pro_case": "Static corroboration exists and function-level reachability evidence is attached.", "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.", "status": "accepted", "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.", "verified": true }, { "context_sources": [ "evidence_level", "finding_id", "function_name", "line", "path", "reachability_conditions", "reachability_evidence", "reachability_status", "severity", "tags", "title" ], "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", "evidence_level": "static_corroboration", "finding_id": "python-ssti:app.py:70", "pro_case": "Static corroboration exists and function-level reachability evidence is attached.", "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.", "status": "accepted", "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.", "verified": true }, { "context_sources": [ "evidence_level", "finding_id", "function_name", "line", "path", "reachability_conditions", "reachability_evidence", "reachability_status", "severity", "tags", "title" ], "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", "evidence_level": "static_corroboration", "finding_id": "python-unsafe-deserialization:app.py:33", "pro_case": "Static corroboration exists and function-level reachability evidence is attached.", "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.", "status": "accepted", "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.", "verified": true }, { "context_sources": [ "evidence_level", "finding_id", "function_name", "line", "path", "reachability_conditions", "reachability_evidence", "reachability_status", "severity", "tags", "title" ], "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", "evidence_level": "static_corroboration", "finding_id": "python-unsafe-deserialization:app.py:38", "pro_case": "Static corroboration exists and function-level reachability evidence is attached.", "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.", "status": "accepted", "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.", "verified": true }, { "context_sources": [ "evidence_level", "finding_id", "function_name", "line", "path", "reachability_conditions", "reachability_evidence", "reachability_status", "severity", "tags", "title" ], "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", "evidence_level": "static_corroboration", "finding_id": "python-unsafe-eval:app.py:28", "pro_case": "Static corroboration exists and function-level reachability evidence is attached.", "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.", "status": "accepted", "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.", "verified": true }, { "context_sources": [ "evidence_level", "finding_id", "function_name", "line", "path", "reachability_conditions", "reachability_evidence", "reachability_status", "severity", "tags", "title" ], "counter_case": "Impact and exploitability still require deeper verifier or dynamic evidence.", "evidence_level": "static_corroboration", "finding_id": "python-weak-hash:app.py:65", "pro_case": "Static corroboration exists and function-level reachability evidence is attached.", "required_next_step": "Proceed to standard verifier or dynamic reproduction if severity warrants it.", "status": "accepted", "tie_breaker": "Confirm attacker control, sanitizer absence, and impact in the next verification depth.", "verified": true } ] }