Claude_Code agent — initial scan
Claude_Code agent initial findings
The application before any remediation. Provenance: the agent wrote this application during this run.
Model disclosure: the application was written by sonnet from Anthropic API, pinned for this run and recorded in the run's evidence. The fix was made by the same agent, but through reachctl remediate, which selects the agent and does not pin its model — so the fixing model is whichever that agent's CLI resolved at run time, and is not asserted here.
Scanner provenance
REACHABLE wheel/build and scan timestamps, read from the scanner database rows that produced the page. Actionable counts are repo.db SIGNAL rows under the product ACTIONABLE_SQL filter.
| Scan | REACHABLE version | Timestamp (UTC) | Commit | Status | Actionable |
|---|---|---|---|---|---|
| Baseline | 1.0.0b199 | 2026-09-12 14:23:33 | a96ec233 | superseded | 11 |
| Baseline | 1.0.0b199 | 2026-09-12 14:27:26 | a96ec233 | complete | 11 |
| Baseline | 1.0.0b199 | 2026-09-12 15:18:55 | 7cd1f3a6 | complete | 6 |
Run estimate
Token estimates are recorded before the run starts. The remediation estimate is recalculated after REACHABLE has the scan database and knows how many findings are in scope.
| Planned runtime | 21-110 minutes |
|---|---|
| Planned model tokens | 53000-475000 total |
| Planned input tokens | 28000-280000 |
| Planned output tokens | 25000-195000 |
| Generation budget | 1800s |
| Remediation scope | 11 |
The application itself was written on the runner and exists only as the published copy: browse the code before remediation, read the generation prompt, open the file listing; fixed code after remediation; side-by-side before/after diff. The source of each finding is linked in the table below.
Remediation scope — 11 finding(s)
repo.db actionable on the baseline scan. Table lists 11 ledger/validation row(s) as evidence.
| # | Severity | Type | Finding | File |
|---|---|---|---|---|
| 1 | CRITICAL | CWE | Flask route sends a non-literal file path — path traversal risk | docs-worker/app.py |
| 2 | HIGH | CWE | SQL query with f-string interpolation — SQL injection risk | docs-worker/app.py |
| 3 | MEDIUM | CWE | Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks. | docs-worker/app.py |
| 4 | MEDIUM | CWE | Running flask app with host 0.0.0.0 could expose the server publicly. | docs-worker/app.py |
| 5 | MEDIUM | CWE | Express app without helmet - missing security headers | portal/src/server.ts |
| 6 | MEDIUM | CWE | XSS: unescaped EJS output <%- footerHtml %> renders raw HTML. Verify the expression does not contain user input. Safe patterns (include, partial, JSON.stringify, view composition) are excluded. | portal/views/statement.ejs |
| 7 | MEDIUM | CWE | XSS: unescaped EJS output <%- customerNote %> renders raw HTML. Verify the expression does not contain user input. Safe patterns (include, partial, JSON.stringify, view composition) are excluded. | portal/views/statement.ejs |
| 8 | MEDIUM | CWE | XSS: unescaped EJS output <%- line.memo %> renders raw HTML. Verify the expression does not contain user input. Safe patterns (include, partial, JSON.stringify, view composition) are excluded. | portal/views/statement.ejs |
| 9 | LOW | SECRET | Hardcoded Stripe-like live secret key detected (sk_live_*) | payments-api/db.go |
| 10 | LOW | SECRET | Hardcoded Stripe-like live secret key detected (sk_live_*) | payments-api/db.go |
| 11 | LOW | CONFIG | Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information. | payments-api/main.go |
Noise — 13 finding(s)
These findings have explicit non-production or unreachable evidence, so they are excluded from the remediation scope. They are listed, not hidden, and each row says which of the two exclusions applies. Nothing has been attempted yet on this page — what became of them is on the result page.
| Why it is excluded | Severity | Type | Finding | File | |
|---|---|---|---|---|---|
| 1 | not reachable | HIGH | CVE | GHSA-72gw-mp4g-v24j | agent-remediation/workspace-remediation/20260912-142724/iteration-01/proof-state/scanner-v0/portal/src/routes/documents.js |
| 2 | not reachable | HIGH | CVE | GHSA-g5hg-p3ph-g8qg | agent-remediation/workspace-remediation/20260912-142724/iteration-01/proof-state/scanner-v0/portal/src/routes/documents.js |
| 3 | not reachable | HIGH | CVE | GHSA-535w-7cp7-47q4 | agent-remediation/workspace-remediation/20260912-142724/iteration-01/proof-state/scanner-v0/portal/src/routes/documents.js |
| 4 | not reachable | HIGH | CVE | GHSA-wc9g-mqfw-jrwm | agent-remediation/workspace-remediation/20260912-142724/iteration-01/proof-state/scanner-v0/portal/src/routes/documents.js |
| 5 | not reachable | HIGH | CVE | GHSA-fjgf-rc76-4x9p | agent-remediation/workspace-remediation/20260912-142724/iteration-01/proof-state/scanner-v0/portal/src/routes/documents.js |
| 6 | not reachable | HIGH | CVE | GHSA-44fp-w29j-9vj5 | agent-remediation/workspace-remediation/20260912-142724/iteration-01/proof-state/scanner-v0/portal/src/routes/documents.js |
| 7 | not reachable | HIGH | CWE | SQL query built with fmt.Sprintf — SQL injection risk | agent-remediation/workspace-remediation/20260912-142724/iteration-01/proof-state/scanner-v0/payments-api/handlers_accounts.go |
| 8 | not reachable | HIGH | CVE | GHSA-xf7r-hgr6-v32p | agent-remediation/workspace-remediation/20260912-142724/iteration-01/proof-state/scanner-v0/portal/src/routes/documents.js |
| 9 | not reachable | HIGH | CVE | GHSA-4pg4-qvpc-4q3h | agent-remediation/workspace-remediation/20260912-142724/iteration-01/proof-state/scanner-v0/portal/src/routes/documents.js |
| 10 | not reachable | HIGH | CVE | GHSA-v52c-386h-88mc | agent-remediation/workspace-remediation/20260912-142724/iteration-01/proof-state/scanner-v0/portal/src/routes/documents.js |
| 11 | not reachable | HIGH | CVE | GHSA-5528-5vmv-3xc2 | agent-remediation/workspace-remediation/20260912-142724/iteration-01/proof-state/scanner-v0/portal/src/routes/documents.js |
| 12 | not reachable | INFO | SUSPICIOUS | New dependency not present in prior version (6.15.2): es-define-property | pkg://qs@6.15.3 |
| 13 | not reachable | LOW | CVE | GHSA-qvfw-j98x-7q72 | agent-remediation/workspace-remediation/20260912-142724/iteration-01/proof-state/scanner-v0/portal/src/routes/documents.js |
What the agent fixed — pass by pass
Each pass hands the still-open findings back to the agent. Started with minus Fixed equals Left on every row, and the last row's Left is what the final scan found.
| Pass | Started with | Fixed | Left | Time | How it ended |
|---|---|---|---|---|---|
| 1 | 11 | 0 | 11 | 845.2s | killed at the budget |
| 2 | 11 | 5 | 6 | 756.3s | killed at the budget |
| Total | 11 | 5 | 6 | 1601.6s | 2 of 2 killed |