git:20260512.574b491 to git:20260512.a4ba040

- Vulnerability Reporting for code flaws, public PRs only for already-disclosed dependency CVEs.

- Uses Semgrep + TruffleHog + osv-scanner + Slither with reachability triage. Use when running

- autonomous security research across a watchlist, pre-launch auditing a contract or library, or

- hardening a dependency tree.

- Triggers: "vuln scan this repo", "audit owner/repo for vulnerabilities", "responsible-disclosure

- scan", "check for secret leaks", "scan dependencies for CVEs".

- Autonomous vulnerability research with a real disclosure pipeline. Picks a target from trending repos (or accepts one explicitly), runs purpose-built scanners with dataflow reachability, triages every candidate by reading the code, and routes each verified finding to the correct channel — **never a public PR for an unpatched code flaw**.

-

- A scanner that dumps zero-days into public PRs isn't a helper. It's a publisher.

- | `var` | Optional. `owner/repo` target. If empty, auto-selects from chained `github-trending` output or a fresh trending API call. |

- - **Skip** intentionally vulnerable teaching repos (juice-shop, webgoat, vulnerable-*, *-ctf, hackme-*).

- - **Skip** if no PVR enabled AND no `SECURITY.md` — no safe channel for code flaws.

- - **Skip** if scanned in the last 30 days (dedup via a local `vuln-scanned.json` state file).

- | Tool | Purpose |

- |---|---|

- | **Semgrep OSS** (`p/security-audit`, `p/owasp-top-ten`, `p/secrets`) | Static analysis with dataflow reachability. |

- | **TruffleHog** (`--only-verified`) | Verified secret detection across filesystem AND full git history. |

- | **osv-scanner** | Unified CVE database across npm/pip/go/cargo/etc. |

- | **Slither** | Solidity static analysis (only if `.sol` present). |

-

- Tool failures are recorded per-source. An all-scanners-failed run reports **error**, never **clean**.

-

- # Semgrep

- --exclude=test --exclude=tests --exclude=examples --exclude=vendor --exclude=node_modules \

- -o /tmp/vuln-scan/semgrep.json .

- # TruffleHog (filesystem + git history)

- trufflehog filesystem . --only-verified --json > /tmp/vuln-scan/trufflehog.json

- trufflehog git file://. --only-verified --json > /tmp/vuln-scan/trufflehog-git.json

- # osv-scanner

- osv-scanner --format=json --recursive . > /tmp/vuln-scan/osv.json

- # Slither (if Solidity)

- slither . --json /tmp/vuln-scan/slither.json --exclude-informational --exclude-low

- ## Triage

- A scanner hit is a candidate, not a vulnerability. For each:

- 1. Open the file at the reported line, read surrounding 30–50 lines.

- 2. Write one sentence: *what attacker controls, what they achieve*. If you can't, discard.

- 4. Assign severity: critical (RCE, auth bypass, secret exposure), high (SQLi, stored XSS, SSRF, path traversal), medium (reflected XSS, weak crypto, missing rate limit).

-

- **Discard** if:

- - Lives in tests, fixtures, examples, docs, or benchmarks.

- - Behind a feature flag not enabled by default.

- - Requires attacker privileges ≥ the attack yields.

- - You'd be embarrassed to defend it to the maintainer.

- | Finding type | Channel | Why |

- |---|---|---|

- | Dependency CVE | **Public PR** bumping the dep | CVE is already public; the patch is net-positive. |

- | Code vulnerability | **PVR** (private advisory) | Publishing creates a zero-day. |

- | Verified leaked secret | **PVR** + rotate request | Public file/line points attackers at the bag. |

- | Smart-contract bug | **PVR** | On-chain exploitation is often immediate and irreversible. |

- | No PVR + no SECURITY.md | **Skip, log** | Do no harm. |

-

- ### Public PR (dep CVEs only)

-

- ```bash

- git checkout -b security/bump-<pkg>-<cve>

- # update lockfile / manifest

- git commit -m "fix(deps): bump <pkg> to patch <CVE-YYYY-NNNN>"

- git push -u origin HEAD

- gh pr create --repo "$REPO" --title "fix(deps): bump <pkg> to patch <CVE-YYYY-NNNN>" --body "..."

- ```

-

- ### PVR (code flaws, secrets, contract bugs)

- -f summary="<short title>" \

- -f severity="<critical|high|medium|low>" \

- -F cwe_ids='["CWE-89"]' \

- -f description="..."

- If the advisories endpoint returns 404/403, PVR is disabled. **Do not fall back to a public issue or PR.** Check `SECURITY.md` for a private contact; if none, log "no safe channel — skipped".

-

- ### Proposed patch (paired with PVR)

-

- If you have a minimal fix, push to your fork only on `private/fix-<slug>`. Do **not** open a PR upstream — link the SHA in the advisory body so the maintainer can cherry-pick.

-

- ## Output

-

- `articles/vuln-scan-${date}.md`:

-

- - Repo metadata, scanner source status (per-tool ok/fail).

- - Candidate count + confirmed count.

- - Findings list with severity + channel (PVR'd findings have file/line redacted; advisory ID linked).

- - Dedup note.

-

- ## Dedup state

-

- `vuln-scanned.json` (local state file) — `{"repo": "owner/name", "scanned_at": "...", "findings": N, "channel": "..."}`. 30-day window.

- `GH_TOKEN` with `repo` + `repository_advisories:write` for the PVR endpoint.

- ## Guidelines

- - **Do no harm.** No safe channel → no publication.

- - Read the code. A scanner hit alone is not a vulnerability.

- - Never post exploit chains publicly. PoCs go in the private advisory.

- - **All-scanners-failed ≠ clean.** Report it as an error and publish nothing.