T3MP3ST v1 — hardened launch (AGPL, verify-claims 24/24, leak-scrubbed)

bench/cve-zero/results/v2-holdout-findings.json

@@ -0,0 +1 @@
+{"schema": "t3mp3st.bench.cve-zero-v2.holdout/v1", "model": "opus-4-8", "effort": "xhigh", "split": "holdout", "built": "2026-07-04", "n": 10, "method": "Full-power pack-hunt on fresh post-cutoff 2026 CVEs the hardened prompts never saw. swarm = 10 hardened specialist classes, findings pooled (no skeptic filter); solo = 1 generalist. Both blind (no ground truth given to the agents).", "scoring": "verify-claims RECOMPUTES strict/lenient/anyHit from these raw findings + committed ground-truth.json via scoreSample/scoreFinding (top-3 by severity; hit = file-match AND (cwe-family OR line\u00b115)). Nothing here is a trusted stored score.", "caveats": "n=10 directional; swarm runs 10 specialists vs solo 1 (recall edge); this config pools without the skeptic used in the cli-swarm bake-off \u2014 NOT a coordination-beats-solo proof. The clean claim is generalization: fresh, unseen, cross-language.", "perSample": [{"id": "GHSA-2fp4-5v5c-4448", "solo": [{"title": "Path traversal in playlist cover-art lookup: attacker-controlled playlist ID resolves to arbitrary filesystem directory outside the playlist base path", "file": "server/ctrlsubsonic/handlers_raw.go", "line": 245, "cwe": "CWE-22", "severity": "high"}, {"title": "Nil pointer dereference (DoS) in getAvatar when an unknown username is supplied", "file": "server/ctrlsubsonic/handlers_raw.go", "line": 352, "cwe": "CWE-476", "severity": "low"}], "swarm": [{"title": "Path traversal in playlist cover art: attacker-controlled base64 id escapes playlist dir, enabling arbitrary directory listing and file read", "file": "server/ctrlsubsonic/handlers_raw.go", "line": 245, "cwe": "CWE-22", "severity": "high"}, {"title": "Path traversal via base64-encoded playlist specid (arbitrary file/dir read & write)", "file": "server/ctrlsubsonic/handlers_playlist.go", "line": 197, "cwe": "CWE-22", "severity": "high"}, {"title": "Unbounded user-controlled slice index in songIndexToRemove causes index-out-of-range panic (DoS)", "file": "server/ctrlsubsonic/handlers_playlist.go", "line": 156, "cwe": "CWE-129", "severity": "low"}, {"title": "getPlaylist: missing playlist ownership/visibility check lets any authenticated user read any private playlist (IDOR)", "file": "server/ctrlsubsonic/handlers_playlist.go", "line": 57, "cwe": "CWE-639", "severity": "high"}, {"title": "deletePlaylist: no ownership check lets any authenticated user delete any user's playlist (IDOR)", "file": "server/ctrlsubsonic/handlers_playlist.go", "line": 183, "cwe": "CWE-639", "severity": "high"}, {"title": "Non-constant-time comparison of stored password enables timing side-channel (CWE-208)", "file": "server/ctrlsubsonic/ctrl.go", "line": 293, "cwe": "CWE-208", "severity": "low"}, {"title": "Non-constant-time comparison of authentication token (CWE-208)", "file": "server/ctrlsubsonic/ctrl.go", "line": 285, "cwe": "CWE-208", "severity": "low"}, {"title": "Arbitrary file write via playlist path traversal (base64 playlist id \u2192 unvalidated filesystem path)", "file": "server/ctrlsubsonic/handlers_playlist.go", "line": 110, "cwe": "CWE-22", "severity": "critical"}, {"title": "Arbitrary file delete via playlist path traversal in ServeDeletePlaylist (no ownership or containment check)", "file": "server/ctrlsubsonic/handlers_playlist.go", "line": 183, "cwe": "CWE-22", "severity": "high"}, {"title": "Arbitrary file read via playlist path traversal (ServeGetPlaylist Read / coverForPlaylist os.Open)", "file": "server/ctrlsubsonic/handlers_playlist.go", "line": 57, "cwe": "CWE-22", "severity": "high"}, {"title": "Unvalidated JSONP `callback` parameter reflected into executable JavaScript response", "file": "server/ctrlsubsonic/ctrl.go", "line": 341, "cwe": "CWE-79", "severity": "low"}, {"title": "Arbitrary file read: getCoverArt playlist cover lookup joins unsanitized traversal path and serves the file", "file": "server/ctrlsubsonic/handlers_podcast.go", "line": 245, "cwe": "CWE-22", "severity": "high"}, {"title": "Broken access control: any authenticated user can read any user's private playlist via /getPlaylist (missing ownership/public check)", "file": "server/ctrlsubsonic/handlers_playlist.go", "line": 51, "cwe": "CWE-639", "severity": "high"}, {"title": "Full-read SSRF: unvalidated http.Get of externally-sourced artist image URL with response reflected to caller", "file": "server/ctrlsubsonic/handlers_raw.go", "line": 184, "cwe": "CWE-918", "severity": "high"}, {"title": "Directory listing and cover-file read via playlist-cover path traversal", "file": "server/ctrlsubsonic/handlers_common.go", "line": 245, "cwe": "CWE-22", "severity": "medium"}, {"title": "Podcast episode download triggers privileged server-side fetch/disk-write with no admin/authorization gate", "file": "server/ctrlsubsonic/handlers_podcast.go", "line": 49, "cwe": "CWE-862", "severity": "medium"}]}, {"id": "GHSA-q6xx-5vr8-p898", "solo": [{"title": "Terminal WebSocket stream (/ws/terminal/{id}) performs no ownership or server-permission check, onlLine truncated