We beweren geen precisie. We bewijzen ze.

Bekende valse positieven

Bevindingen die de engine produceert op code die niet kwetsbaar is. Ze tellen mee tegen de precisie hierboven en worden er niet uit weggelaten.

• CWE-798 cybseco-cicd — `DEPLOY_TOKEN = credentials('deploy-token')` is the documented Jenkins idiom for *not* committing a credential: it binds a value stored in the credential store. The rule sees NAME = <call> and reports a hardcoded secret.
• CWE-284 cybseco-terraform — The rule reads source_address_prefix and destination_address_prefix into one list and fires if any entry is `*`. Here the wildcard is the destination, which on an inbound NSG rule means 'anywhere inside the protected scope'; the source is a bastion subnet, 10.1.0.0/24.
• CWE-78 cybseco-llm — The completion is used as a key into a table of commands the developer wrote, and a key outside the table is refused before the call. Nothing the model emits becomes a command. This is the recommended mitigation for the vulnerability the rule looks for.
• CWE-89 cybseco-llm — The SQL text is a constant; the model only selects which named query to run, and the value travels as a bound parameter. The rule fires on a completion and a query execution appearing in the same function.
• CWE-918 cybseco-llm — The host is compared against a frozen allow-list and the request is refused otherwise, so metadata endpoints and internal services are unreachable. The rule does not see the check between the completion and the request.
• CWE-200 cybseco-llm — `page_token` is a pagination cursor. The sensitive-name pattern matches the word `token` regardless of what it holds.