PROOF-DRIVEN SAST VALIDATION & CLAIM VERIFICATION ENGINE

Finding Validation & Hybrid Proof Engine

Do not ask the AI whether a vulnerability looks exploitable. Gather static and runtime evidence, execute controlled validators bound to exact build commits, and independently verify 6-point proof contracts.

Python Stack (Click to Inspect Module)

SCANNING & VALIDATING (0%)Stage A–B: Ingesting SARIF 2.1.0 & Locking Commit SHA...

🖨️ Print / Report Engine Open Repo / Code Scanner

[A–B] SARIF + Commit Lock [C] 7-Factor Optimizer [D] 9 Python Standards Plugins [E] 6-Point Proof Verifier [F] Remediation & Regression Ready (5 Findings) 

Security Validation Scorecard (Click Any Card or KPI Below to Filter & Inspect Proof Telemetry)

Interactive · Click any metric card to filter queue & view breakdown

CONFIRMED · BLOCK RELEASERuntime Confirmed — 36 Exploitable Findings (6/6 Proof Contract Satisfied)

Findings where static reachability AND controlled runtime/AST verification satisfied all 6 points of the Independent Evidence Verifier Proof Contract.

Verification Rule: Requires Source Provenance + Sink Reachability + Missing Guard + Behavioral Proof + Ruled-Out WAF + Reproducibility.

Target Architecture (Stages A → F) · Click a stage to inspect its contract

Stage E — Independent Evidence Verifier: Independently evaluates whether collected artifacts satisfy the finding-specific proof contract on the exact tested commit before permitting CONFIRMED status.

Canonical Finding Queue (Priority 1–5 Validators · Multi-Language AST Adapters)

Authorization & Access Control Validator (Priority 1)

VAL-101: Cross-Tenant Invoice Read in BillingService

github.com/acme-corp/billing-api · app/api/routes/invoices.py:64–79

Commit Lock: a4f92c81 == a4f92c81

Status: CONFIRMED · Confidence: 99%

Canonical Data-Flow & Runtime Context

Source: invoice_id: UUID (Path param)

Call Chain: invoices.get_invoice_by_id() → InvoiceRepository.fetch_one(invoice_id) → session.execute(select(Invoice).where(Invoice.id == invoice_id))

Sink: session.execute() without tenant_id predicate

Endpoint: GET /api/v1/invoices/{invoice_id}

Preserved Original Scanner Record (SARIF 2.1.0)

driver: XTRIKE AST-Query 2.19.1
ruleId: py/missing-object-level-authorization
loc: app/api/routes/invoices.py:64:5
codeFlows: 1 preserved

Validator Execution Lifecycle (1. Preflight → 2. Assess → 3. Plan → 4. Execute → 5. Verify)

1. Preflight — Scope authorized · commit a4f92c81 matches running container build42 ms

Verified repository in authorized_scope, commit_sha == build_commit_sha (a4f92c81e03b4d12), and seeded two disposable test tenants.

2. Assess — Route reachable · SQLAlchemy WHERE clause filters by Invoice.id only118 ms

Python AST + XTRIKE-CST inspection confirmed Depends(get_current_user) is present, but current_user.tenant_id is never passed to InvoiceRepository.fetch_one().

3. Plan — Scheduled P1 Role-Matrix & Resource Ownership comparison (2 principals)28 ms

Planned controlled GET on fixture resource INV-TEST-009 owned by Tenant-B using Tenant-A session token. Stop condition: 2 requests max.

4. Execute — Tenant-A principal received Tenant-B fixture record (3/3 repeatable runs)310 ms

XTRIKE-HTTP recorded HTTP 200 with fixture JSON matching Tenant-B resource checksum; XTRIKE-Trace DB span confirmed query lacked tenant_id filter.

5. Verify — 6/6 Proof Contract criteria satisfied → Status: CONFIRMED (99% confidence)54 ms

IndependentEvidenceVerifier confirmed resource ownership boundary violation across 3 deterministic runs on commit a4f92c81.

Independent Evidence Verifier · 6-Point Proof Contract

Source provenanceSATISFIED · DataFlow

Did the tested input originate from the relevant user-controlled source?

Path parameter invoice_id traced directly from XTRIKE-API route handler.

Sink reachabilitySATISFIED · XTRIKE-Trace Trace

Did the input reach the sensitive operation along an active call path?

XTRIKE-Trace span confirmed InvoiceRepository.fetch_one() executed.

Security controlSATISFIED · AST

Was the operation missing an effective authorization or ownership guard?

Authentication present, but tenant_id ownership predicate is absent.

Behavioral proofSATISFIED · Controlled Check

Did controlled test inputs demonstrate unauthorized resource access?

Tenant-A principal retrieved Tenant-B fixture record body (not just HTTP 200).

Alternative explanationsSATISFIED · App Log

Have caching, public resource flags, and mock fallbacks been ruled out?

Cache-Control: no-store verified; fixture marked private to Tenant-B.

ReproducibilitySATISFIED · Controlled Check

Can the behavior be reproduced on the same build and configuration?

Reproduced 3/3 times on build-2026.10.16-a4f92c81.

Suggested Remediation Patch

stmt = select(Invoice).where(
    Invoice.id == invoice_id,
    Invoice.tenant_id == current_user.tenant_id,
)

Automated Regression Test

def test_cross_tenant_invoice_access_denied(client, tenant_a_token, tenant_b_invoice):
    res = client.get(f"/api/v1/invoices/{tenant_b_invoice.id}", headers=tenant_a_token)
    assert res.status_code == 404