From d2d1cf5f17e8b014caa1bda0e946857f60fcdc1f Mon Sep 17 00:00:00 2001 From: robert Date: Thu, 4 Jun 2026 03:37:33 -0400 Subject: [PATCH] update prompt --- resources/specs/claude-security-scan.md | 1 + 1 file changed, 1 insertion(+) diff --git a/resources/specs/claude-security-scan.md b/resources/specs/claude-security-scan.md index c680ea97..0ec9b410 100644 --- a/resources/specs/claude-security-scan.md +++ b/resources/specs/claude-security-scan.md @@ -481,6 +481,7 @@ PRECEDENTS - Mongoose-specific filtering decisions: 28. Keep availability findings when one malformed packet, request, certificate, DNS response, MQTT message, WebSocket frame, or small sequence can reliably crash, wedge, corrupt, or disrupt a Mongoose target. 29. Keep custom backend findings only when the issue is in Mongoose’s backend interface, default backend, documented backend contract, or common backend implementation. 30. When uncertain, keep findings with clear external input, reachable code path, and concrete impact in Mongoose library/protocol/driver code; filter internal-access, impossible-state, local-misuse, generic-hardening, and speculative reports. +31. For dashboard reports, do not infer unauthenticated access from a route-specific check alone; account for the broader authentication flow. Keep concrete reachable bugs such as path traversal, unsafe decoded paths, or file read/write/delete issues. ## DIRECTORY AND FILE EXCLUSIONS