Phase 2: Built-in Scanner Hardening & SARIF Export

[ToryMic]

Phase 2 — Built-in Scanner Hardening

Depends on: Phase 1 ✅ (docs/prd.md)

Drips Wave alignment

• Complements RytScan (on-chain) with deeper web-layer detection
• Maps to Wave security patterns: injection flaws, missing auth headers, verbose errors

Deliverables

• Expand OWASP Top 10 probe coverage in app/services/owasp_top10.py
• False-positive tuning and severity calibration in finding_utils.py
• Parameter fuzz budget profiles (quick / standard / deep) in config.py
• SARIF v2.1.0 export endpoint GET /api/scans/{id}/report/sarif
• Regression fixture suite against DVWA/Juice Shop baselines
• Document finding counts in thesis Chapter 4

Acceptance criteria

• make test passes with new regression fixtures
• DVWA Low scan produces ≥ 15 findings with < 20% duplicate rate
• SARIF output validates against GitHub Code Scanning schema
• README updated with SARIF usage example

References

• ShieldScan architecture §3.1
• Drips Wave catalog: https://www.drips.network/wave/stellar/issues