mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-17 03:59:28 +00:00
Marius CiepluchandClaude Opus 5
289648338c
Task 1.1. Ten families are the only key that routes work and scores a pair; CWE ids and mechanism ids are attributes reached through a family. Each family names what can confirm a claim in it: a sandbox canary for injection, file path and deserialization, static corroboration for access control, nothing for the rest. The unknown family carries the mechanisms that span families and the weaknesses this project deliberately does not target, so a declined row is visible instead of silently unresolved. Every labeled corpus weakness resolves, no weakness id is claimed twice, and every mechanism in the closed vocabulary belongs to exactly one family. Open redirect joins server-side request forgery under one untrusted-destination family because both are untrusted input choosing a request destination; that places 34 real rows instead of discarding them. The relation lookup answers same, parent-child, lateral or fabricated, and abstention earns no partial credit: unknown against a real family is lateral. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG