mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 5
5b7288aa58
Four decisions, recorded after the family detection census and the PHP correction. They change sequence and declared scope; they change no acceptance threshold and no owner boundary. Close M3 at a scale whose questions complete, before anything else. The not-established PHP record came from two instrument defects rather than from the analyser, and bounded to 25 and 100 regions PMPro completes with no timeout and establishes a true-positive SQL injection. Tasks 13.3 and 13.4 carry the replay and the question-completion gap, the second because admission reads outcomes and M4 measures completion at 95 percent. Reserve the untouched M4 population now, in parallel. M4 already permits preparation before the frozen candidate exists and it is the longest lead-time item on the path. Task 15.1. M2 is the only engineering item left and cannot be scoped away: a changed-code transaction spends its whole budget in the build, and meeting the latency gate by analysing less is explicitly not the same result. Declare the v1 advisory scope as the families whose claims can be ADMITTED, which requires the entailed rung: injection, untrusted destination and configuration. Access control is excluded because on an application that splits route from data access the obligation is carried and a carried obligation corroborates by design, so the family would ship as silence. Task 15.2. The risk the amendment does not remove is stated with it: every number so far comes from subjects used to build the analyser, one week of examining two of them surfaced seven false positives, and the first independent evaluation should be expected to fail. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo