## TLCTC SAST Report
_Project: `demo` &middot; TLCTC v2.1_

**Findings classified:** 6 &nbsp;|&nbsp; **Low-confidence:** 1 &nbsp;|&nbsp; **Total issues seen:** 7

### Cluster Exposure

| Cluster | Name | Count |
|---|---|---:|
| `#2` | Exploiting Server | 3 |
| `#3` | Exploiting Client | 1 |
| `#4` | Identity Theft | 1 |
| `#10` | Supply Chain Attack | 1 |

### `#2` Exploiting Server &mdash; 3 finding(s)

- **ISSUE-001** &mdash; `demo:src/main/java/com/example/UserRepo.java`
  - Rule: `java:S2077` (severity `BLOCKER`, type `VULNERABILITY`)
  - CWE: CWE-89
  - CWE-89 &rarr; `#2` (Allowed) &mdash; no alternation; no role resolution required
  - _Format SQL queries using parameterized binding rather than string concatenation._
- **ISSUE-002** &mdash; `demo:src/main/java/com/example/render/JspRenderer.java`
  - Rule: `java:S5131` (severity `CRITICAL`, type `VULNERABILITY`)
  - CWE: CWE-79
  - CWE-79 &rarr; `#2 → #7` (Allowed) &mdash; no glob match; fell back to default_role=server
  - _User-supplied data is rendered into the response without contextual escaping._
- **ISSUE-006** &mdash; `demo:src/main/java/com/example/api/SessionLoader.java`
  - Rule: `java:S5135` (severity `CRITICAL`, type `VULNERABILITY`)
  - CWE: CWE-502
  - CWE-502 &rarr; `#2 → #7` (Allowed) &mdash; component path matched server glob '**/api/**'
  - _Deserialization of untrusted data without integrity verification._

### `#3` Exploiting Client &mdash; 1 finding(s)

- **ISSUE-003** &mdash; `demo:src/main/webapp/components/CommentList.tsx`
  - Rule: `typescript:S5247` (severity `MAJOR`, type `VULNERABILITY`)
  - CWE: CWE-79
  - CWE-79 &rarr; `#3` (Allowed) &mdash; component path matched client glob '**/*.tsx'
  - _DOM sink receives data from a URL parameter without sanitization._

### `#4` Identity Theft &mdash; 1 finding(s)

- **ISSUE-004** &mdash; `demo:src/main/java/com/example/config/AwsClient.java`
  - Rule: `secrets:S6290` (severity `BLOCKER`, type `VULNERABILITY`)
  - CWE: CWE-798
  - CWE-798 &rarr; `#4` (Allowed) &mdash; no alternation; no role resolution required
  - _Hardcoded AWS access key detected in source._

### `#10` Supply Chain Attack &mdash; 1 finding(s)

- **ISSUE-007** &mdash; `demo:pom.xml`
  - Rule: `xml:S6320` (severity `MAJOR`, type `VULNERABILITY`)
  - CWE: CWE-829
  - CWE-829 &rarr; `#10 → #7` (Allowed) &mdash; no alternation; no role resolution required
  - _Dependency declared without an integrity-verifying checksum or signature._

<details>
<summary>Low-confidence findings (Discouraged verdict)</summary>

- **ISSUE-005** &mdash; `demo:src/main/java/com/example/api/UploadHandler.java` (CWE-20)
  - CWE-20 (Discouraged) &mdash; raw mapping `N/A`
</details>

---
_Generated by `tlctc-sonar` against the canonical CWE&rarr;TLCTC mapping._
