vuln-scanlisted

# Vuln Scan — Systematic Vulnerability Scanner ## Iron Law Code you haven't traced from input to sink has vulnerabilities you haven't found. A grep hit is a lead, not a finding. ## Process ### Step 0: Load Engagement Context Check for `.harness/engagement.md`. If present, load scope constraints — only scan in-scope paths and respect exclusions. Check for `THREAT_MODEL.md` from a previous `/threat-model` run. If present, use its threat scenarios as scan targets. If absent, run full-surface scan. ### Step 1: Map Entry Points to Trust Boundaries Enumerate every place untrusted data enters the system, by reading the code: - **External → app**: HTTP handlers/routers, GraphQL resolvers, webhooks, file uploads, form fields, query params, headers - **Process boundary**: CLI args, environment variables, IPC, deserialization of stored data (cache, DB rows written earlier, config files) - **Client-supplied state**: cookies, JWT claims, API keys, referer/origin For each entry point, note: what validation exists (yes/no/partial), and where the data flows next. This list is the scan's backbone — a scan that cannot name its entry points has not started. ### Step 2: Trace Data Flow to Sinks From each entry point, follow the data by reading code until it reaches a dangerous operation, or dies (validated, parameterized, dropped). Dangerous sink classes: | Sink class | Examples (non-exhaustive) | |-----------|--------------------------| | Command/code execution | shell invocation,