Cursor agent — initial scan
Cursor agent initial findings
The application before any remediation. Provenance: the agent wrote this application during this run.
Model disclosure: the application was written by gpt-5.4-mini from Cursor Models, pinned for this run and recorded in the run's evidence. The fix was made by the same agent, but through reachctl remediate, which selects the agent and does not pin its model — so the fixing model is whichever that agent's CLI resolved at run time, and is not asserted here.
Scanner provenance
REACHABLE wheel/build and scan timestamps, read from the scanner database rows that produced the page. Actionable counts are repo.db SIGNAL rows under the product ACTIONABLE_SQL filter.
| Scan | REACHABLE version | Timestamp (UTC) | Commit | Status | Actionable |
|---|---|---|---|---|---|
| Baseline | 1.0.0b199 | 2026-09-12 15:12:51 | 156aff7f | superseded | 21 |
| Baseline | 1.0.0b199 | 2026-09-12 15:16:19 | 156aff7f | complete | 22 |
| Baseline | 1.0.0b199 | 2026-09-12 15:39:27 | 0e5b4506 | complete | 17 |
Run estimate
Token estimates are recorded before the run starts. The remediation estimate is recalculated after REACHABLE has the scan database and knows how many findings are in scope.
| Planned runtime | 21-110 minutes |
|---|---|
| Planned model tokens | 53000-475000 total |
| Planned input tokens | 28000-280000 |
| Planned output tokens | 25000-195000 |
| Generation budget | 1800s |
| Remediation scope | 21 |
The application itself was written on the runner and exists only as the published copy: browse the code before remediation, read the generation prompt, open the file listing; fixed code after remediation; side-by-side before/after diff. The source of each finding is linked in the table below.
Remediation scope — 21 finding(s)
repo.db actionable on the baseline scan. Table lists 21 ledger/validation row(s) as evidence.
| # | Severity | Type | Finding | File |
|---|---|---|---|---|
| 1 | CRITICAL | CWE | User-controlled path joined into filesystem path - path traversal risk | portal/src/server.ts |
| 2 | CRITICAL | CWE | Flask route sends a non-literal file path — path traversal risk | docs-worker/app.py |
| 3 | HIGH | CWE | SQL query constructed with template interpolation before query/prepare — CWE-89. Use parameterized queries instead. | portal/src/server.ts |
| 4 | HIGH | CWE | SQL query constructed with template interpolation before query/prepare — CWE-89. Use parameterized queries instead. | portal/src/server.ts |
| 5 | HIGH | CVE | GHSA-rmj7-2vxq-3g9f | risk-api/src/main/java/com/treasury/risk/RiskApi.java |
| 6 | HIGH | CVE | GHSA-j3rv-43j4-c7qm | risk-api/src/main/java/com/treasury/risk/RiskApi.java |
| 7 | HIGH | CVE | GHSA-rmj7-2vxq-3g9f | risk-api/src/main/java/com/treasury/risk/RiskApi.java |
| 8 | HIGH | CVE | GHSA-j3rv-43j4-c7qm | risk-api/src/main/java/com/treasury/risk/RiskApi.java |
| 9 | MEDIUM | CWE | Running flask app with host 0.0.0.0 could expose the server publicly. | docs-worker/app.py |
| 10 | MEDIUM | CVE | GHSA-5gvw-p9qm-jgwh | risk-api/src/main/java/com/treasury/risk/RiskApi.java |
| 11 | MEDIUM | CVE | GHSA-hgj6-7826-r7m5 | risk-api/src/main/java/com/treasury/risk/RiskApi.java |
| 12 | MEDIUM | CVE | GHSA-5gvw-p9qm-jgwh | risk-api/src/main/java/com/treasury/risk/RiskApi.java |
| 13 | MEDIUM | CVE | GHSA-5jmj-h7xm-6q6v | risk-api/src/main/java/com/treasury/risk/RiskApi.java |
| 14 | MEDIUM | CVE | GHSA-5jmj-h7xm-6q6v | risk-api/src/main/java/com/treasury/risk/RiskApi.java |
| 15 | MEDIUM | CVE | GHSA-3pjw-73gf-8qr5 | risk-api/src/main/java/com/treasury/risk/RiskApi.java |
| 16 | MEDIUM | CVE | GHSA-hgj6-7826-r7m5 | risk-api/src/main/java/com/treasury/risk/RiskApi.java |
| 17 | MEDIUM | CVE | GHSA-mhm7-754m-9p8w | risk-api/src/main/java/com/treasury/risk/RiskApi.java |
| 18 | MEDIUM | CVE | GHSA-3pjw-73gf-8qr5 | risk-api/src/main/java/com/treasury/risk/RiskApi.java |
| 19 | MEDIUM | CVE | GHSA-mhm7-754m-9p8w | risk-api/src/main/java/com/treasury/risk/RiskApi.java |
| 20 | LOW | CONFIG | Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information. | payments-api/main.go |
| 21 | LOW | CVE | GHSA-68rp-wp8r-4726 | docs-worker/app.py |
Noise — 8 finding(s)
These findings have explicit non-production or unreachable evidence, so they are excluded from the remediation scope. They are listed, not hidden, and each row says which of the two exclusions applies. Nothing has been attempted yet on this page — what became of them is on the result page.
| Why it is excluded | Severity | Type | Finding | File | |
|---|---|---|---|---|---|
| 1 | not reachable | HIGH | CWE | Database credential detected. Use IAM database authentication where available. Store credentials in a secrets manager with automatic rotation. Use connection poolers with credential injection (PgBounc | agent-remediation/workspace-remediation/20260912-151617/iteration-01/proof-state/scanner-v0/payments-api/main.go |
| 2 | not reachable | LOW | SECRET | Hardcoded variable `TESTING` detected. Use environment variables or config files instead | agent-remediation/workspace-remediation/20260912-151617/iteration-01/proof-state/scanner-v0/docs-worker/test_app.py |
| 3 | not reachable | MEDIUM | CWE | Internal error details written to HTTP response — exposes server internals (table names, paths, stack traces) to clients. Return a generic error message and log the detail server-side. | agent-remediation/workspace-remediation/20260912-151617/iteration-01/proof-state/scanner-v0/payments-api/main.go |
| 4 | not reachable | MEDIUM | CWE | Internal error details written to HTTP response — exposes server internals (table names, paths, stack traces) to clients. Return a generic error message and log the detail server-side. | agent-remediation/workspace-remediation/20260912-151617/iteration-01/proof-state/scanner-v0/payments-api/main.go |
| 5 | not reachable | MEDIUM | CWE | Internal error details written to HTTP response — exposes server internals (table names, paths, stack traces) to clients. Return a generic error message and log the detail server-side. | agent-remediation/workspace-remediation/20260912-151617/iteration-01/proof-state/scanner-v0/payments-api/main.go |
| 6 | not reachable | MEDIUM | CWE | Internal error details written to HTTP response — exposes server internals (table names, paths, stack traces) to clients. Return a generic error message and log the detail server-side. | agent-remediation/workspace-remediation/20260912-151617/iteration-01/proof-state/scanner-v0/payments-api/main.go |
| 7 | not reachable | MEDIUM | CWE | Internal error details written to HTTP response — exposes server internals (table names, paths, stack traces) to clients. Return a generic error message and log the detail server-side. | agent-remediation/workspace-remediation/20260912-151617/iteration-01/proof-state/scanner-v0/payments-api/main.go |
| 8 | not reachable | MEDIUM | CWE | Internal error details written to HTTP response — exposes server internals (table names, paths, stack traces) to clients. Return a generic error message and log the detail server-side. | agent-remediation/workspace-remediation/20260912-151617/iteration-01/proof-state/scanner-v0/payments-api/main.go |
What the agent fixed — pass by pass
Each pass hands the still-open findings back to the agent. Started with minus Fixed equals Left on every row, and the last row's Left is what the final scan found.
| Pass | Started with | Fixed | Left | Time | How it ended |
|---|---|---|---|---|---|
| 1 | 21 | 0 | 22 | 475.1s | ran to completion |
| 2 | 22 | 5 | 17 | 530.9s | killed at the budget |
| Total | 21 | 5 | 17 | 1006.0s | 1 of 2 killed |