mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 5
f13934c663
The scoreboard now carries a real finding: CVE-2023-23488 at class.memberorder.php:936, the exact line, in unmodified plugin code, with 16 of 26 unprepared $wpdb queries reported in that file and zero of the 26 using ->prepare. And the reading the maintainer's instinct produced: **the first real CVE was found by cutting, not by scanning more.** Two of 637 files load in 9 seconds and report the bug; the full checkout does not load at all. That two-file slice IS the contributor case -- a developer editing class.memberorder.php gets precisely that scan -- so scoping is not a workaround for a scale problem, it is the thesis, and the scale problem is what happens when the thesis is ignored. The distinction recorded is not whether to cut but who decides and whether the decision survives: a build declaration, a diff or a subtree is chosen by the project or the developer and is recoverable from the artifact, while a model judging "this looks like boilerplate" gives the same answer when right and tells you nothing when it drops the file holding the bug. Every failure found on this checkout was of that second shape. Also corrects "one language is demonstrated" to two, with the honest limit attached: PHP works on a real plugin slice and not at repository scale. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG