{
  "coverage": {
    "files_failed": 0,
    "files_scanned": 4,
    "files_skipped": 0,
    "rules_run": 935
  },
  "crypto": {
    "coverage": {
      "algorithms": 65,
      "files_scanned": 2,
      "files_skipped": 0,
      "test_files": 1
    },
    "uses": [
      {
        "algorithm": "SHA-256",
        "assessment": "acceptable",
        "evidence": "return jsonify({\"receipt\": hashlib.sha256(order_id.encode()).hexdigest()})",
        "kind": "hash",
        "line": 26,
        "note": "Sound today. Grover's algorithm halves the work of finding a collision, which leaves SHA-256 adequate but makes SHA-384 the choice where a signature must hold for decades.",
        "path": "app.py"
      }
    ]
  },
  "dependencies": {
    "coverage": {
      "advisories": 288353,
      "bundle_built_at": "2026-10-09T06:30:43Z",
      "bundle_digest": "sha256:e9866473b379d6bd61939709c3cd0efbb50de8e84591865617a39c81a65f0f50",
      "components_checked": 9
    },
    "findings": null
  },
  "findings": [
    {
      "column": 1,
      "confidence": "low",
      "cwe": [
        306,
        862
      ],
      "end_line": 20,
      "fingerprint": "sha256:cd51ffe0aec634000e0a3d684946c521327861fa337317d9aadc4635408f49ec",
      "line": 16,
      "message": "REVIEW: This view has no authentication applied at the view. Global middleware, URL wrappers or handler helpers may still protect it. Confirm the actual route and object or function permissions before confirming anonymous access.",
      "owasp": [
        "A01:2021"
      ],
      "path": "app.py",
      "remediation": "Protect the view with an authentication decorator such as flask_login's @login_required (or Django's login_required), then check that the signed-in user may access the specific record.",
      "severity": "high",
      "snippet": "@app.get(\"/orders\") ...",
      "title": "REVIEW: View lacks an authentication requirement"
    },
    {
      "column": 1,
      "confidence": "low",
      "cwe": [
        306
      ],
      "end_line": 20,
      "fingerprint": "sha256:cb6bd390c3b5c495b9d8bf82bbb2ec25bbbaa52a57a58f4ef7c74b813f94e0d4",
      "line": 16,
      "message": "REVIEW: This route declares no authentication dependency. Application or router dependencies, middleware and checks in the handler may still enforce access. Verify effective registration and permissions before confirming forced browsing or authorisation bypass.",
      "owasp": [
        "A01:2021"
      ],
      "path": "app.py",
      "remediation": "Declare an authentication dependency on the route (viewer = Depends(current_user)) or on the APIRouter, and use the authenticated identity to scope the data returned.",
      "severity": "high",
      "snippet": "@app.get(\"/orders\") ...",
      "title": "REVIEW: FastAPI route lacks an authentication dependency"
    }
  ],
  "inventory": {
    "components": [
      {
        "direct": true,
        "purl": "pkg:pypi/blinker@1.9.0"
      },
      {
        "direct": true,
        "purl": "pkg:pypi/click@8.1.8"
      },
      {
        "direct": true,
        "purl": "pkg:pypi/flask@3.1.3"
      },
      {
        "direct": true,
        "purl": "pkg:pypi/importlib-metadata@8.7.1"
      },
      {
        "direct": true,
        "purl": "pkg:pypi/itsdangerous@2.2.0"
      },
      {
        "direct": true,
        "purl": "pkg:pypi/jinja2@3.1.6"
      },
      {
        "direct": true,
        "purl": "pkg:pypi/markupsafe@3.0.4"
      },
      {
        "direct": true,
        "purl": "pkg:pypi/werkzeug@3.1.9"
      },
      {
        "direct": true,
        "purl": "pkg:pypi/zipp@3.23.1"
      }
    ],
    "manifests": [
      "requirements.txt"
    ]
  },
  "provenance": {
    "advisory_built_at": "2026-10-09T06:30:43Z",
    "advisory_digest": "sha256:e9866473b379d6bd61939709c3cd0efbb50de8e84591865617a39c81a65f0f50",
    "finished_at": "2026-10-10T06:00:34.781705Z",
    "include_tests": false,
    "passes": [
      {
        "name": "sast",
        "status": "completed"
      },
      {
        "name": "iac",
        "status": "completed"
      },
      {
        "name": "sca",
        "status": "completed"
      },
      {
        "name": "secrets",
        "status": "completed"
      },
      {
        "name": "sbom",
        "status": "completed"
      },
      {
        "name": "cbom",
        "status": "completed"
      },
      {
        "name": "aibom",
        "reason": "separate aibom command",
        "status": "not_requested"
      },
      {
        "name": "malicious",
        "reason": "separate malicious package check",
        "status": "not_requested"
      }
    ],
    "started_at": "2026-10-10T06:00:31.592809Z"
  },
  "secrets": {
    "coverage": {
      "detectors": 56,
      "files_scanned": 7,
      "files_skipped": 0
    },
    "findings": []
  }
}