Run #4

{
  "paths": [
    "/home/ubuntu/sw/swesweep-fasthttp"
  ],
  "files_from": null,
  "re_triage": null,
  "report": null,
  "triage_levels": null,
  "skip_existing": false,
  "model": "qwen/qwen3.8-27b",
  "backend": "koscompute",
  "api_url": null,
  "openrouter_provider": null,
  "parallel": 4,
  "scan_parallel": null,
  "triage_parallel": null,
  "max_connections": null,
  "timeout": 600,
  "thinking": "medium",
  "thinking_scan": null,
  "thinking_triage": null,
  "retries": 20000,
  "max_chars": 350000,
  "extensions": ".go",
  "ignore_dirs": null,
  "skip_tests": true,
  "output_dir": "/home/ubuntu/nano-analyzer-results/swesweep-fasthttp",
  "triage_threshold": "medium",
  "triage_rounds": 5,
  "min_confidence": 0.0,
  "project": null,
  "repo_dir": null,
  "verbose_triage": false,
  "debug_info": null,
  "threat_model": "library",
  "custom_threat_model": null,
  "custom_threat_model_file": null,
  "threat_model_autodetect": true,
  "budget_usd": null,
  "deadline": null,
  "prices_file": null,
  "db": "/home/ubuntu/nano-analyzer-results/swesweep-fasthttp/scan.db",
  "resume": true,
  "summary_sections": {}
}

{
  "profile": "library",
  "fingerprint": "00ff1b1a7b11",
  "sources": [
    {
      "kind": "profile",
      "label": "library",
      "chars": 1526,
      "truncated": false
    }
  ],
  "effective": [
    {
      "kind": "profile",
      "label": "library",
      "chars": 1526,
      "truncated": false
    }
  ],
  "warnings": [],
  "contradiction": null,
  "scan_text": "[Profile: library (Reusable library / SDK)]\nAttacker: Code that calls the public API, and above all the data it passes through: parsers, decoders, deserializers and protocol handlers receive adversarial payloads that the host application obtained from untrusted sources.\nEntry points / trust boundary: Public (exported) functions, methods, constructors and callbacks, and every buffer, string, file or stream handed to them. Internal and private helpers are reachable only through the public surface.\nAssets and impact: Memory safety and integrity of the host process (out-of-bounds access, use-after-free, type confusion); correct behaviour on malformed input; resource bounds (unbounded allocation, algorithmic complexity, infinite loops on crafted input); concurrency invariants of components documented as thread-safe.",
  "triage_text": "[Profile: library (Reusable library / SDK)]\nAttacker: Code that calls the public API, and above all the data it passes through: parsers, decoders, deserializers and protocol handlers receive adversarial payloads that the host application obtained from untrusted sources.\nEntry points / trust boundary: Public (exported) functions, methods, constructors and callbacks, and every buffer, string, file or stream handed to them. Internal and private helpers are reachable only through the public surface.\nAssets and impact: Memory safety and integrity of the host process (out-of-bounds access, use-after-free, type confusion); correct behaviour on malformed input; resource bounds (unbounded allocation, algorithmic complexity, infinite loops on crafted input); concurrency invariants of components documented as thread-safe.\nNot a vulnerability under this model: Missing parameter validation in non-public (internal, private, static) functions that are not directly reachable from outside when the public boundary already enforces the invariant; misuse that violates a documented precondition of the public API.\nVerdict rules: Trust invariants: the public API must validate all inputs. Non-public methods may assume invariants verified at the public boundary; do not report missing parameter validation in them as a security vulnerability unless the code is directly reachable from outside or a public path can deliver input that violates the invariant. A crash, memory corruption or unbounded resource use reachable through the public API with a crafted payload is VALID."
}