valuation-api

Why those were dismissed

Two keys had to turn. The model had to name a reason from a fixed list of six, and a deterministic check of ours — over which files this artifact actually installs — had to independently agree. Anything it could not corroborate is in “not reviewed” above, at full severity.

• 2 CI or editor configuration — The match is in build, CI or editor configuration, confirmed by our own check to be outside the installed artifact.

  Rules: AAK-GHA-IMMUTABLE-001 · Files: .github/workflows/main_valuation-backend-api.yml · reported by agent-audit-kit

In installed code — never dismissed

These findings are in files this artifact installs and are not placeholder values. No false-positive basis can be corroborated for such a finding, so this review never dismisses one; they were not sent to the model and stand at their scanner's severity.

• 6 FILE_MAGIC_MISMATCH

  Files: /repo/app/__init__.py, /repo/app/data/__init__.py, /repo/app/models/__init__.py and 3 more · reported by cisco-skill-scanner

• 2 PYSEC-2024-38

  Files: /repo/poetry.lock, /repo/requirements.txt · reported by osv-scanner

• 2 PYSEC-2026-2132

  Files: /repo/poetry.lock · reported by osv-scanner

• 1 CVE-2024-47874

  Files: poetry.lock · reported by trivy

• 1 CVE-2025-54121

  Files: poetry.lock · reported by trivy

• 1 CVE-2025-66418

  Files: poetry.lock · reported by trivy

• 1 CVE-2025-66471

  Files: poetry.lock · reported by trivy

• 1

Upheld — the review declined to dismiss these

The model could have called any of these a false positive and did not.

• 1 CVE-2026-54282

  Files: poetry.lock · reported by trivy

Not reviewed

• 2 The model called these false positives and our own check did not agree, so the dismissal was refused.

  Rules: UNANALYZABLE_BINARY, BINARY_FILE_DETECTED · Files: /repo/.env.example · reported by cisco-skill-scanner