template-report

SCA Vulnerability Scan Report

Scan Information

• **Repository**: <repo_path>
• **Scan ID**: <scan_id>
• **Date**: <timestamp>
• **Scanner**: Wraith (OSV-Scanner) + Ghost AI Exploitability Analysis

---

Executive Summary

<2-3 paragraphs summarizing:

• Number of lockfiles scanned and total dependencies analyzed
• High severity findings that require immediate action
• Overall security posture (clean, concerning, critical)
• False positive reduction achieved by AI analysis>

---

Statistics

| Metric | Count | |--------|-------| | Lockfiles Scanned | <count> | | Packages Scanned | <count> | | Vulnerabilities Detected | <count> (raw scanner output) | | Candidates Analyzed | <count> | | Confirmed Findings | <count> (exploitable) | | False Positives Filtered | <count> | | False Positive Rate | <percentage>% |

Findings by Severity

| Severity | Count | Recommended Timeline | |----------|-------|----------------------| | High | <count> | Within 1 week | | Medium | <count> | Within 1 month | | Low | <count> | Plan for next quarter |

Findings by Ecosystem

| Ecosystem | Findings | Total Packages | |-----------|----------|----------------| | Go | <count> | <count> | | npm | <count> | <count> | | PyPI | <count> | <count> | | RubyGems | <count> | <count> | | Cargo | <count> | <count> |

Findings by Lockfile

| Lockfile | Findings | Packages | Status | |----------|----------|----------|--------| | go.mod | <count> | <count> | <clean/vulnerable> | | frontend/package-lock.json | <count> | <count> | <clean/vulnerable> | | requirements.txt | <count> | <count> | <clean/vulnerable> |

---

High Severity Findings

<For each HIGH finding:>

<Package Name> @ <Version> - <Vulnerability ID>

• **Location**: `<lockfile-path>`
• **CVEs**: <CVE-IDs>
• **CVSS Score**: <score>
• **Summary**: <1-line vulnerability summary>
• **Exploitability**: <Why this is exploitable in this codebase>
• **Impact**: <What an attacker could achieve>
• **Remediation**: Upgrade to `<package>@<fixed-version>`

**Exploit Path**:

User Input → <entry point> → <vulnerable function> → <impact>

**Detailed Analysis**: See [<scan_dir>/findings/<finding-id>.md](<scan_dir>/findings/<finding-id>.md)

---

Medium Severity Findings

<For each MEDIUM finding, similar format but may be more condensed>

<Package Name> @ <Version> - <Vulnerability ID>

• **Location**: `<lockfile-path>`
• **CVEs**: <CVE-IDs>
• **CVSS Score**: <score>
• **Summary**: <1-line summary>
• **Remediation**: Upgrade to `<package>@<fixed-version>`

**Detailed Analysis**: See [<scan_dir>/findings/<finding-id>.md](<scan_dir>/findings/<finding-id>.md)

---

Low Severity Findings

<For LOW findings, use condensed table format>

| Package | Version | Vuln ID | CVE | CVSS | Remediation | |---------|---------|---------|-----|------|-------------| | <package> | <version> | <vuln_id> | <cve> | <score> | Upgrade to <fixed_version> | | <package> | <version> | <vuln_id> | <cve> | <score> | Upgrade to <fixed_version> |

---

False Positives Filtered

The AI analysis successfully filtered <count> false positives that were not exploitable:

Not Used in Codebase (<count>)

• **<package>@<version>** - <vuln_id>: Package imported but vulnerable function not called
• **<package>@<version>** - <vuln_id>: Only safe submodules used, vulnerable code not reached
• **<package>@<version>** - <vuln_id>: Transitive dependency never directly imported

Test Dependencies Only (<count>)

• **<package>@<version>** - <vuln_id>: Only used in test files (test/), not in production
• **<package>@<version>** - <vuln_id>: Listed in devDependencies, excluded from production build
• **<package>@<version>** - <vuln_id>: Test-only usage, not deployed

Mitigated (<count>)

• **<package>@<version>** - <vuln_id>: Effective input validation wrapper in place
• **<package>@<version>** - <vuln_id>: WAF rules block exploit attempts
• **<package>@<version>** - <vuln_id>: Custom fork with backported patch

Version Overrides (<count>)

• **<package>@<version>** - <vuln_id>: Actually using patched version via `replace` directive
• **<package>@<version>** - <vuln_id>: Fixed via package.json resolutions
• **<package>@<version>** - <vuln_id>: Internal fork with security patches

---

Remediation Plan

High Priority Actions (High Severity)

<For each HIGH finding, provide specific upgrade instructions>

1. <Package> @ <Version> - <Vuln ID>

• **Action**: Upgrade to `<package>@<fixed-version>`
• **Testing Required**:
• <functionality area 1 that uses this package>
• <functionality area 2>
• <integration/e2e tests>
• **Estimated Effort**: <hours/days>
• **Command**:

     # Go
     go get <package>@<version>
     go mod tidy

     # npm
     npm install <package>@<version>
     npm audit

     # Python (poetry)
     poetry add <package>@<version>
     poetry lock

     # Python (pip)
     pip install <package>==<version>
     pip freeze > requirements.txt

     # Ruby
     bundle update <package>

     # Rust
     cargo update <package>

Medium Priority Actions (Medium Severity)

<Similar format for MEDIUM findings>

Low Priority Actions (Low Severity)

<Condensed list or table format>

• **<package>@<version>**: Upgrade to <fixed_version>
• **<package>@<version>**: Upgrade to <fixed_version>

Long-Term Security Improvements

1. **Automated Dependency Scanning**

• Integrate wraith into CI/CD pipeline
• Fail builds on High severity vulnerabilities
• Run weekly scans on main/production branches
• Set up automated alerts for new vulnerabilities

2. **Dependency Update Policy**

• Enable automated dependency updates (Dependabot, Renovate Bot)
• Establish regular security patch windows (e.g., monthly)
• Pin major versions, auto-update patches
• Review and approve dependency additions

3. **Secure Development Practices**

• Review security track record before adding new dependencies