Sharang ParnerkarandClaude Fable 5 753ecefaae fix(semgrep): extract CWE from list-form metadata (was always null) ...

semgrep emits metadata.cwe as a LIST (e.g. "CWE-798: Use of Hard-coded
Credentials"), but the extractor called v.as_str() on it -> always None, so SAST
findings never carried a CWE at all (silently breaking control mapping AND the
CWE-based dedup). Handle list + bare-string forms and normalise to the CWE-NNN
id. Found by the live control-triage end-to-end test.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-21 10:55:00 +02:00

..

src

fix(semgrep): extract CWE from list-form metadata (was always null)

2026-07-21 10:55:00 +02:00

tests

feat(oscal): live assessment endpoint POST /api/v1/oscal/assess (#212)

2026-07-20 19:13:47 +00:00

Cargo.toml

feat(agent): control triage — LLM false-positive filter over tool findings

2026-07-21 10:20:31 +02:00