Codex agent — initial scan
Codex agent initial findings
The application before any remediation. Provenance: the agent wrote this application during this run.
Model disclosure: the application was written by gpt-5.5 from OpenAI API, pinned for this run and recorded in the run's evidence. The fix was made by the same agent, but through reachctl remediate, which selects the agent and does not pin its model — so the fixing model is whichever that agent's CLI resolved at run time, and is not asserted here.
Scanner provenance
REACHABLE wheel/build and scan timestamps, read from the scanner database rows that produced the page. Actionable counts are repo.db SIGNAL rows under the product ACTIONABLE_SQL filter.
| Scan | REACHABLE version | Timestamp (UTC) | Commit | Status | Actionable |
|---|---|---|---|---|---|
| Baseline | 1.0.0b199 | 2026-09-12 14:17:03 | 48eb92fc | superseded | 7 |
| Baseline | 1.0.0b199 | 2026-09-12 14:21:29 | 48eb92fc | superseded | 8 |
| Baseline | 1.0.0b199 | 2026-09-12 15:19:23 | 48eb92fc | complete | 7 |
Run estimate
Token estimates are recorded before the run starts. The remediation estimate is recalculated after REACHABLE has the scan database and knows how many findings are in scope.
| Planned runtime | 21-110 minutes |
|---|---|
| Planned model tokens | 53000-475000 total |
| Planned input tokens | 28000-280000 |
| Planned output tokens | 25000-195000 |
| Generation budget | 1800s |
| Remediation scope | 7 |
The application itself was written on the runner and exists only as the published copy: browse the code before remediation, read the generation prompt, open the file listing; fixed code after remediation; side-by-side before/after diff. The source of each finding is linked in the table below.
Remediation scope — 7 finding(s)
repo.db actionable on the baseline scan. Table lists 7 ledger/validation row(s) as evidence.
| # | Severity | Type | Finding | File |
|---|---|---|---|---|
| 1 | CRITICAL | CWE | User-controlled path joined into filesystem path - path traversal risk | portal/src/server.ts |
| 2 | CRITICAL | CWE | Flask route sends a non-literal file path — path traversal risk | docs-worker/app.py |
| 3 | HIGH | CWE | SQL query with f-string interpolation — SQL injection risk | docs-worker/app.py |
| 4 | HIGH | CWE | SQL query built with string concatenation — use PreparedStatement with parameterized queries instead. | risk-api/src/main/java/com/sthenos/treasury/RiskApi.java |
| 5 | MEDIUM | CWE | File read on a path built from external input without resolving symlinks and validating the result stays inside the expected directory — CWE-59 symlink following. An attacker who controls the director | docs-worker/app.py |
| 6 | LOW | CONFIG | Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information. | payments-api/main.go |
| 7 | LOW | CVE | GHSA-68rp-wp8r-4726 | docs-worker/app.py |
Noise — 22 finding(s)
These findings have explicit non-production or unreachable evidence, so they are excluded from the remediation scope. They are listed, not hidden, and each row says which of the two exclusions applies. Nothing has been attempted yet on this page — what became of them is on the result page.
| Why it is excluded | Severity | Type | Finding | File | |
|---|---|---|---|---|---|
| 1 | not reachable | HIGH | CVE | GHSA-535w-7cp7-47q4 | agent-remediation/workspace-remediation/20260912-142126/iteration-01/proof-state/scanner-v0/portal/src/server.ts |
| 2 | not reachable | HIGH | CVE | GHSA-fjgf-rc76-4x9p | agent-remediation/workspace-remediation/20260912-142126/iteration-01/proof-state/scanner-v0/portal/src/server.ts |
| 3 | not reachable | HIGH | CWE | User-controlled value interpolated into a query string via fmt.Sprintf — potential code injection (CWE-94). The interpolated value may allow arbitrary query commands. Use parameterized queries or stri | agent-remediation/workspace-remediation/20260912-142126/iteration-01/proof-state/scanner-v0/payments-api/main.go |
| 4 | not reachable | HIGH | DLP | PII data sent to external HTTP endpoint — data leakage risk. | agent-remediation/workspace-remediation/20260912-142126/iteration-01/proof-state/scanner-v0/payments-api/main.go |
| 5 | not reachable | HIGH | CVE | GHSA-wc9g-mqfw-jrwm | agent-remediation/workspace-remediation/20260912-142126/iteration-01/proof-state/scanner-v0/portal/src/server.ts |
| 6 | not reachable | HIGH | CVE | GHSA-xf7r-hgr6-v32p | agent-remediation/workspace-remediation/20260912-142126/iteration-01/proof-state/scanner-v0/portal/src/server.ts |
| 7 | not reachable | HIGH | CVE | GHSA-44fp-w29j-9vj5 | agent-remediation/workspace-remediation/20260912-142126/iteration-01/proof-state/scanner-v0/portal/src/server.ts |
| 8 | not reachable | HIGH | CVE | GHSA-g5hg-p3ph-g8qg | agent-remediation/workspace-remediation/20260912-142126/iteration-01/proof-state/scanner-v0/portal/src/server.ts |
| 9 | not reachable | HIGH | CVE | GHSA-5528-5vmv-3xc2 | agent-remediation/workspace-remediation/20260912-142126/iteration-01/proof-state/scanner-v0/portal/src/server.ts |
| 10 | not reachable | HIGH | CWE | SQL query with f-string interpolation — SQL injection risk | agent-remediation/workspace-remediation/20260912-142126/iteration-01/proof-state/scanner-v0/docs-worker/app.py |
| 11 | not reachable | HIGH | CVE | GHSA-72gw-mp4g-v24j | agent-remediation/workspace-remediation/20260912-142126/iteration-01/proof-state/scanner-v0/portal/src/server.ts |
| 12 | not reachable | HIGH | CVE | GHSA-v52c-386h-88mc | agent-remediation/workspace-remediation/20260912-142126/iteration-01/proof-state/scanner-v0/portal/src/server.ts |
| 13 | not reachable | HIGH | CWE | SQL query built with fmt.Sprintf — SQL injection risk | agent-remediation/workspace-remediation/20260912-142126/iteration-01/proof-state/scanner-v0/payments-api/main.go |
| 14 | not reachable | HIGH | CVE | GHSA-4pg4-qvpc-4q3h | agent-remediation/workspace-remediation/20260912-142126/iteration-01/proof-state/scanner-v0/portal/src/server.ts |
| 15 | not reachable | INFO | SUSPICIOUS | New dependency not present in prior version (6.15.2): es-define-property | pkg://qs@6.15.3 |
| 16 | not reachable | LOW | CVE | GHSA-qvfw-j98x-7q72 | agent-remediation/workspace-remediation/20260912-142126/iteration-01/proof-state/scanner-v0/portal/src/server.ts |
| 17 | not reachable | MEDIUM | CWE | Internal error details written to HTTP response — exposes server internals (table names, paths, stack traces) to clients. Return a generic error message and log the detail server-side. | agent-remediation/workspace-remediation/20260912-142126/iteration-01/proof-state/scanner-v0/payments-api/main.go |
| 18 | not reachable | MEDIUM | CWE | Internal error details written to HTTP response — exposes server internals (table names, paths, stack traces) to clients. Return a generic error message and log the detail server-side. | agent-remediation/workspace-remediation/20260912-142126/iteration-01/proof-state/scanner-v0/payments-api/main.go |
| 19 | not reachable | MEDIUM | CWE | HTTP response status code is never checked. 4xx/5xx errors and 3xx redirects are silently treated as successful responses, potentially processing error pages as valid data (CWE-391). Add: if resp.Stat | agent-remediation/workspace-remediation/20260912-142126/iteration-01/proof-state/scanner-v0/payments-api/main.go |
| 20 | not reachable | MEDIUM | CWE | Internal error details written to HTTP response — exposes server internals (table names, paths, stack traces) to clients. Return a generic error message and log the detail server-side. | agent-remediation/workspace-remediation/20260912-142126/iteration-01/proof-state/scanner-v0/payments-api/main.go |
| 21 | not reachable | MEDIUM | CWE | Unbounded read of HTTP response body — DoS via large response. Wrap with io.LimitReader: io.ReadAll(io.LimitReader(resp.Body, maxBytes)) | agent-remediation/workspace-remediation/20260912-142126/iteration-01/proof-state/scanner-v0/payments-api/main.go |
| 22 | not reachable | MEDIUM | CWE | Internal error details written to HTTP response — exposes server internals (table names, paths, stack traces) to clients. Return a generic error message and log the detail server-side. | agent-remediation/workspace-remediation/20260912-142126/iteration-01/proof-state/scanner-v0/payments-api/main.go |
What the agent fixed — pass by pass
Each pass hands the still-open findings back to the agent. Started with minus Fixed equals Left on every row, and the last row's Left is what the final scan found.
No remediation passes were recorded for this run.