[
 {
  "id": "C01",
  "http_status": 200,
  "recorded_at": "2026-11-03T22:46:46+00:00",
  "ms": 56,
  "reply": {
   "verdict": "PASS",
   "findings": [],
   "finding_count": 0,
   "severity_counts": {
    "CRITICAL": 0,
    "HIGH": 0,
    "MEDIUM": 0,
    "LOW": 0
   },
   "files_checked": 2,
   "lines_added": 12,
   "lines_removed": 0,
   "diff_sha256": "dc079582b35e41ba22b71285f1ceed9fda68682db77823dc1f52f54ad1d937f0",
   "source": {
    "repo": "acme/payments",
    "pr": 415,
    "title": "Extract fee calculation",
    "author": "copilot-swe-agent[bot]",
    "ai_agent": true
   },
   "engine_version": "keystone-ci-1.1.0",
   "checked_ms": 2.89,
   "sample_id": "clean-refactor",
   "title": "Clean refactor with a new test (passes)",
   "attestation": {
    "payloadType": "application/vnd.in-toto+json",
    "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJwcmVkaWNhdGUiOnsiY2hlY2tlZF9hdCI6IjIwMjYtMTEtMDNUMjI6NDY6NDZaIiwiZmlsZXNfY2hlY2tlZCI6MiwiZmluZGluZ3MiOltdLCJnYXRlIjp7ImRldGVybWluaXN0aWMiOnRydWUsImVuZ2luZSI6ImtleXN0b25lLWNpLTEuMS4wIiwibW9kZWxfaW5fZGVjaXNpb24iOmZhbHNlfSwic2V2ZXJpdHlfY291bnRzIjp7IkNSSVRJQ0FMIjowLCJISUdIIjowLCJMT1ciOjAsIk1FRElVTSI6MH0sInNvdXJjZSI6eyJhaV9hZ2VudCI6dHJ1ZSwiYXV0aG9yIjoiY29waWxvdC1zd2UtYWdlbnRbYm90XSIsInByIjo0MTUsInJlcG8iOiJhY21lL3BheW1lbnRzIiwidGl0bGUiOiJFeHRyYWN0IGZlZSBjYWxjdWxhdGlvbiJ9LCJ2ZXJkaWN0IjoiUEFTUyJ9LCJwcmVkaWNhdGVUeXBlIjoiaHR0cHM6Ly9jYWluc3R1ZGlvLm9ubGluZS9rZXlzdG9uZS1jaS9wcmVkaWNhdGUvdjEiLCJzdWJqZWN0IjpbeyJkaWdlc3QiOnsic2hhMjU2IjoiZGMwNzk1ODJiMzVlNDFiYTIyYjcxMjg1ZjFjZWVkOWZkYTY4NjgyZGI3NzgyM2RjMWY1MmY1NGFkMWQ5MzdmMCJ9LCJuYW1lIjoiYWNtZS9wYXltZW50cyM0MTUifV19",
    "signatures": [
     {
      "keyid": "SHA256:2232b4add9b35d4016e5be270df4ed56e0dc9b39a0530ac69891073253aae90d",
      "sig": "9Vf0n/GQ9MWMc93NfX3ximubXDtWHdQ109Tts03TYMSmqaric5WuCQ63WjbEPEZoYgiEj192EDiWjhxBBm7CCQ=="
     }
    ]
   }
  }
 },
 {
  "id": "C02",
  "http_status": 200,
  "recorded_at": "2026-11-03T22:46:47+00:00",
  "ms": 55,
  "reply": {
   "verdict": "REVIEW",
   "findings": [
    {
     "check": "test_deleted",
     "severity": "HIGH",
     "detail": "deletes a test file",
     "file": "tests/test_auth.py"
    },
    {
     "check": "assertion_gutted",
     "severity": "HIGH",
     "detail": "replaces 3 real assertion(s) with one that can never fail",
     "file": "tests/test_refunds.py"
    },
    {
     "check": "assertion_weakened",
     "severity": "HIGH",
     "detail": "replaces 3 exact assertion(s) with checks that only test that something came back",
     "file": "tests/test_refunds.py"
    },
    {
     "check": "assertions_removed",
     "severity": "HIGH",
     "detail": "removes 3 assertions and adds 0",
     "file": "tests/test_refunds.py"
    },
    {
     "check": "test_disabled",
     "severity": "HIGH",
     "detail": "skips, x-outs or focuses a test, so other tests stop running",
     "file": "tests/test_refunds.py",
     "line": 11
    },
    {
     "check": "vacuous_assertion",
     "severity": "MEDIUM",
     "detail": "an assertion that can never fail",
     "file": "tests/test_refunds.py",
     "line": 15
    }
   ],
   "finding_count": 6,
   "severity_counts": {
    "CRITICAL": 0,
    "HIGH": 5,
    "MEDIUM": 1,
    "LOW": 0
   },
   "files_checked": 2,
   "lines_added": 3,
   "lines_removed": 7,
   "diff_sha256": "77786ba392bef2f576108f6d9080a5eec2f0c105db18be8c120631e3e3e72847",
   "source": {
    "repo": "acme/payments",
    "pr": 412,
    "title": "Fix flaky CI",
    "author": "copilot-swe-agent[bot]",
    "ai_agent": true
   },
   "engine_version": "keystone-ci-1.1.0",
   "checked_ms": 3.31,
   "sample_id": "agent-skips-tests",
   "title": "Agent 'fixes' CI by skipping and gutting tests",
   "attestation": {
    "payloadType": "application/vnd.in-toto+json",
    "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJwcmVkaWNhdGUiOnsiY2hlY2tlZF9hdCI6IjIwMjYtMTEtMDNUMjI6NDY6NDdaIiwiZmlsZXNfY2hlY2tlZCI6MiwiZmluZGluZ3MiOlt7ImNoZWNrIjoidGVzdF9kZWxldGVkIiwiZGV0YWlsIjoiZGVsZXRlcyBhIHRlc3QgZmlsZSIsImZpbGUiOiJ0ZXN0cy90ZXN0X2F1dGgucHkiLCJzZXZlcml0eSI6IkhJR0gifSx7ImNoZWNrIjoiYXNzZXJ0aW9uX2d1dHRlZCIsImRldGFpbCI6InJlcGxhY2VzIDMgcmVhbCBhc3NlcnRpb24ocykgd2l0aCBvbmUgdGhhdCBjYW4gbmV2ZXIgZmFpbCIsImZpbGUiOiJ0ZXN0cy90ZXN0X3JlZnVuZHMucHkiLCJzZXZlcml0eSI6IkhJR0gifSx7ImNoZWNrIjoiYXNzZXJ0aW9uX3dlYWtlbmVkIiwiZGV0YWlsIjoicmVwbGFjZXMgMyBleGFjdCBhc3NlcnRpb24ocykgd2l0aCBjaGVja3MgdGhhdCBvbmx5IHRlc3QgdGhhdCBzb21ldGhpbmcgY2FtZSBiYWNrIiwiZmlsZSI6InRlc3RzL3Rlc3RfcmVmdW5kcy5weSIsInNldmVyaXR5IjoiSElHSCJ9LHsiY2hlY2siOiJhc3NlcnRpb25zX3JlbW92ZWQiLCJkZXRhaWwiOiJyZW1vdmVzIDMgYXNzZXJ0aW9ucyBhbmQgYWRkcyAwIiwiZmlsZSI6InRlc3RzL3Rlc3RfcmVmdW5kcy5weSIsInNldmVyaXR5IjoiSElHSCJ9LHsiY2hlY2siOiJ0ZXN0X2Rpc2FibGVkIiwiZGV0YWlsIjoic2tpcHMsIHgtb3V0cyBvciBmb2N1c2VzIGEgdGVzdCwgc28gb3RoZXIgdGVzdHMgc3RvcCBydW5uaW5nIiwiZmlsZSI6InRlc3RzL3Rlc3RfcmVmdW5kcy5weSIsImxpbmUiOjExLCJzZXZlcml0eSI6IkhJR0gifSx7ImNoZWNrIjoidmFjdW91c19hc3NlcnRpb24iLCJkZXRhaWwiOiJhbiBhc3NlcnRpb24gdGhhdCBjYW4gbmV2ZXIgZmFpbCIsImZpbGUiOiJ0ZXN0cy90ZXN0X3JlZnVuZHMucHkiLCJsaW5lIjoxNSwic2V2ZXJpdHkiOiJNRURJVU0ifV0sImdhdGUiOnsiZGV0ZXJtaW5pc3RpYyI6dHJ1ZSwiZW5naW5lIjoia2V5c3RvbmUtY2ktMS4xLjAiLCJtb2RlbF9pbl9kZWNpc2lvbiI6ZmFsc2V9LCJzZXZlcml0eV9jb3VudHMiOnsiQ1JJVElDQUwiOjAsIkhJR0giOjUsIkxPVyI6MCwiTUVESVVNIjoxfSwic291cmNlIjp7ImFpX2FnZW50Ijp0cnVlLCJhdXRob3IiOiJjb3BpbG90LXN3ZS1hZ2VudFtib3RdIiwicHIiOjQxMiwicmVwbyI6ImFjbWUvcGF5bWVudHMiLCJ0aXRsZSI6IkZpeCBmbGFreSBDSSJ9LCJ2ZXJkaWN0IjoiUkVWSUVXIn0sInByZWRpY2F0ZVR5cGUiOiJodHRwczovL2NhaW5zdHVkaW8ub25saW5lL2tleXN0b25lLWNpL3ByZWRpY2F0ZS92MSIsInN1YmplY3QiOlt7ImRpZ2VzdCI6eyJzaGEyNTYiOiI3Nzc4NmJhMzkyYmVmMmY1NzYxMDhmNmQ5MDgwYTVlZWMyZjBjMTA1ZGIxOGJlOGMxMjA2MzFlM2UzZTcyODQ3In0sIm5hbWUiOiJhY21lL3BheW1lbnRzIzQxMiJ9XX0=",
    "signatures": [
     {
      "keyid": "SHA256:2232b4add9b35d4016e5be270df4ed56e0dc9b39a0530ac69891073253aae90d",
      "sig": "UjREEQ8rC9kD5PzSNzIarQb2sgGAVlpG7RuINbZ6bsNH04XKtwngCtpnMcyI7dvtw2Q6I2aEuGwE/c/R1sYbCg=="
     }
    ]
   }
  }
 },
 {
  "id": "C03",
  "http_status": 200,
  "recorded_at": "2026-11-03T22:46:47+00:00",
  "ms": 56,
  "reply": {
   "verdict": "BLOCK",
   "findings": [
    {
     "check": "pwn_request",
     "severity": "CRITICAL",
     "detail": "pull_request_target plus a checkout of the PR's own code: any fork can run code with this repository's secrets and write token",
     "file": ".github/workflows/preview.yml",
     "line": 10
    },
    {
     "check": "ci_pipeline_change",
     "severity": "HIGH",
     "detail": "changes a CI/CD pipeline: a code owner should review it",
     "file": ".github/workflows/preview.yml"
    },
    {
     "check": "workflow_write_all",
     "severity": "HIGH",
     "detail": "grants the workflow token write access to everything",
     "file": ".github/workflows/preview.yml",
     "line": 3
    },
    {
     "check": "workflow_script_injection",
     "severity": "HIGH",
     "detail": "puts attacker-controlled text (PR title/body/branch) straight into the workflow; pass it through an env variable instead",
     "file": ".github/workflows/preview.yml",
     "line": 12
    },
    {
     "check": "secret_printed_in_ci",
     "severity": "HIGH",
     "detail": "prints a secret into the CI log",
     "file": ".github/workflows/preview.yml",
     "line": 16
    },
    {
     "check": "action_not_pinned",
     "severity": "MEDIUM",
     "detail": "third-party action someone/deploy-preview@main is not pinned to a commit SHA",
     "file": ".github/workflows/preview.yml",
     "line": 11
    },
    {
     "check": "ci_failure_suppressed",
     "severity": "MEDIUM",
     "detail": "a failing CI step is ignored",
     "file": ".github/workflows/preview.yml",
     "line": 13
    }
   ],
   "finding_count": 7,
   "severity_counts": {
    "CRITICAL": 1,
    "HIGH": 4,
    "MEDIUM": 2,
    "LOW": 0
   },
   "files_checked": 1,
   "lines_added": 16,
   "lines_removed": 0,
   "diff_sha256": "af962f5c4fd4be2d65ce3112addc6fe1beabda1cbbd501d826e0649cf1abb5dc",
   "source": {
    "repo": "acme/web",
    "pr": 88,
    "title": "ci: run preview on external PRs",
    "author": "devin-ai-integration[bot]",
    "ai_agent": true
   },
   "engine_version": "keystone-ci-1.1.0",
   "checked_ms": 2.84,
   "sample_id": "pwn-request",
   "title": "Workflow that hands repo secrets to any fork PR",
   "attestation": {
    "payloadType": "application/vnd.in-toto+json",
    "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJwcmVkaWNhdGUiOnsiY2hlY2tlZF9hdCI6IjIwMjYtMTEtMDNUMjI6NDY6NDdaIiwiZmlsZXNfY2hlY2tlZCI6MSwiZmluZGluZ3MiOlt7ImNoZWNrIjoicHduX3JlcXVlc3QiLCJkZXRhaWwiOiJwdWxsX3JlcXVlc3RfdGFyZ2V0IHBsdXMgYSBjaGVja291dCBvZiB0aGUgUFIncyBvd24gY29kZTogYW55IGZvcmsgY2FuIHJ1biBjb2RlIHdpdGggdGhpcyByZXBvc2l0b3J5J3Mgc2VjcmV0cyBhbmQgd3JpdGUgdG9rZW4iLCJmaWxlIjoiLmdpdGh1Yi93b3JrZmxvd3MvcHJldmlldy55bWwiLCJsaW5lIjoxMCwic2V2ZXJpdHkiOiJDUklUSUNBTCJ9LHsiY2hlY2siOiJjaV9waXBlbGluZV9jaGFuZ2UiLCJkZXRhaWwiOiJjaGFuZ2VzIGEgQ0kvQ0QgcGlwZWxpbmU6IGEgY29kZSBvd25lciBzaG91bGQgcmV2aWV3IGl0IiwiZmlsZSI6Ii5naXRodWIvd29ya2Zsb3dzL3ByZXZpZXcueW1sIiwic2V2ZXJpdHkiOiJISUdIIn0seyJjaGVjayI6IndvcmtmbG93X3dyaXRlX2FsbCIsImRldGFpbCI6ImdyYW50cyB0aGUgd29ya2Zsb3cgdG9rZW4gd3JpdGUgYWNjZXNzIHRvIGV2ZXJ5dGhpbmciLCJmaWxlIjoiLmdpdGh1Yi93b3JrZmxvd3MvcHJldmlldy55bWwiLCJsaW5lIjozLCJzZXZlcml0eSI6IkhJR0gifSx7ImNoZWNrIjoid29ya2Zsb3dfc2NyaXB0X2luamVjdGlvbiIsImRldGFpbCI6InB1dHMgYXR0YWNrZXItY29udHJvbGxlZCB0ZXh0IChQUiB0aXRsZS9ib2R5L2JyYW5jaCkgc3RyYWlnaHQgaW50byB0aGUgd29ya2Zsb3c7IHBhc3MgaXQgdGhyb3VnaCBhbiBlbnYgdmFyaWFibGUgaW5zdGVhZCIsImZpbGUiOiIuZ2l0aHViL3dvcmtmbG93cy9wcmV2aWV3LnltbCIsImxpbmUiOjEyLCJzZXZlcml0eSI6IkhJR0gifSx7ImNoZWNrIjoic2VjcmV0X3ByaW50ZWRfaW5fY2kiLCJkZXRhaWwiOiJwcmludHMgYSBzZWNyZXQgaW50byB0aGUgQ0kgbG9nIiwiZmlsZSI6Ii5naXRodWIvd29ya2Zsb3dzL3ByZXZpZXcueW1sIiwibGluZSI6MTYsInNldmVyaXR5IjoiSElHSCJ9LHsiY2hlY2siOiJhY3Rpb25fbm90X3Bpbm5lZCIsImRldGFpbCI6InRoaXJkLXBhcnR5IGFjdGlvbiBzb21lb25lL2RlcGxveS1wcmV2aWV3QG1haW4gaXMgbm90IHBpbm5lZCB0byBhIGNvbW1pdCBTSEEiLCJmaWxlIjoiLmdpdGh1Yi93b3JrZmxvd3MvcHJldmlldy55bWwiLCJsaW5lIjoxMSwic2V2ZXJpdHkiOiJNRURJVU0ifSx7ImNoZWNrIjoiY2lfZmFpbHVyZV9zdXBwcmVzc2VkIiwiZGV0YWlsIjoiYSBmYWlsaW5nIENJIHN0ZXAgaXMgaWdub3JlZCIsImZpbGUiOiIuZ2l0aHViL3dvcmtmbG93cy9wcmV2aWV3LnltbCIsImxpbmUiOjEzLCJzZXZlcml0eSI6Ik1FRElVTSJ9XSwiZ2F0ZSI6eyJkZXRlcm1pbmlzdGljIjp0cnVlLCJlbmdpbmUiOiJrZXlzdG9uZS1jaS0xLjEuMCIsIm1vZGVsX2luX2RlY2lzaW9uIjpmYWxzZX0sInNldmVyaXR5X2NvdW50cyI6eyJDUklUSUNBTCI6MSwiSElHSCI6NCwiTE9XIjowLCJNRURJVU0iOjJ9LCJzb3VyY2UiOnsiYWlfYWdlbnQiOnRydWUsImF1dGhvciI6ImRldmluLWFpLWludGVncmF0aW9uW2JvdF0iLCJwciI6ODgsInJlcG8iOiJhY21lL3dlYiIsInRpdGxlIjoiY2k6IHJ1biBwcmV2aWV3IG9uIGV4dGVybmFsIFBScyJ9LCJ2ZXJkaWN0IjoiQkxPQ0sifSwicHJlZGljYXRlVHlwZSI6Imh0dHBzOi8vY2FpbnN0dWRpby5vbmxpbmUva2V5c3RvbmUtY2kvcHJlZGljYXRlL3YxIiwic3ViamVjdCI6W3siZGlnZXN0Ijp7InNoYTI1NiI6ImFmOTYyZjVjNGZkNGJlMmQ2NWNlMzExMmFkZGM2ZmUxYmVhYmRhMWNiYmQ1MDFkODI2ZTA2NDljZjFhYmI1ZGMifSwibmFtZSI6ImFjbWUvd2ViIzg4In1dfQ==",
    "signatures": [
     {
      "keyid": "SHA256:2232b4add9b35d4016e5be270df4ed56e0dc9b39a0530ac69891073253aae90d",
      "sig": "lgMlGyQiMaUsYczPQxIE+VkSfimitTT6w0BNkuKLDnTNICzR59NzxY2Ayz5a3bDJOem9Aq8q9sn9Y3PxAO0fCw=="
     }
    ]
   }
  }
 },
 {
  "id": "C04",
  "http_status": 200,
  "recorded_at": "2026-11-03T22:46:48+00:00",
  "ms": 78,
  "reply": {
   "verdict": "BLOCK",
   "findings": [
    {
     "check": "secret_committed",
     "severity": "CRITICAL",
     "detail": "commits a aws access key (AKIA…******); rotate it, the history keeps it",
     "file": ".env",
     "line": 2
    },
    {
     "check": "secret_committed",
     "severity": "CRITICAL",
     "detail": "commits a aws access key (AKIA…******); rotate it, the history keeps it",
     "file": "ingest/s3.py",
     "line": 4
    },
    {
     "check": "env_file_committed",
     "severity": "HIGH",
     "detail": "commits a .env file",
     "file": ".env"
    },
    {
     "check": "tls_verification_disabled",
     "severity": "HIGH",
     "detail": "turns off TLS certificate checking",
     "file": "ingest/s3.py",
     "line": 7
    }
   ],
   "finding_count": 4,
   "severity_counts": {
    "CRITICAL": 2,
    "HIGH": 2,
    "MEDIUM": 0,
    "LOW": 0
   },
   "files_checked": 2,
   "lines_added": 8,
   "lines_removed": 0,
   "diff_sha256": "878fe7b0f520753e656d32bbe87687d76831b59b28dbacb6856a50165d24cb5e",
   "source": {
    "repo": "acme/ingest",
    "pr": 1290,
    "title": "Add S3 upload",
    "author": "dev-intern",
    "ai_agent": false
   },
   "engine_version": "keystone-ci-1.1.0",
   "checked_ms": 1.57,
   "sample_id": "committed-key",
   "title": "Cloud key and .env committed with the feature",
   "attestation": {
    "payloadType": "application/vnd.in-toto+json",
    "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJwcmVkaWNhdGUiOnsiY2hlY2tlZF9hdCI6IjIwMjYtMTEtMDNUMjI6NDY6NDhaIiwiZmlsZXNfY2hlY2tlZCI6MiwiZmluZGluZ3MiOlt7ImNoZWNrIjoic2VjcmV0X2NvbW1pdHRlZCIsImRldGFpbCI6ImNvbW1pdHMgYSBhd3MgYWNjZXNzIGtleSAoQUtJQeKApioqKioqKik7IHJvdGF0ZSBpdCwgdGhlIGhpc3Rvcnkga2VlcHMgaXQiLCJmaWxlIjoiLmVudiIsImxpbmUiOjIsInNldmVyaXR5IjoiQ1JJVElDQUwifSx7ImNoZWNrIjoic2VjcmV0X2NvbW1pdHRlZCIsImRldGFpbCI6ImNvbW1pdHMgYSBhd3MgYWNjZXNzIGtleSAoQUtJQeKApioqKioqKik7IHJvdGF0ZSBpdCwgdGhlIGhpc3Rvcnkga2VlcHMgaXQiLCJmaWxlIjoiaW5nZXN0L3MzLnB5IiwibGluZSI6NCwic2V2ZXJpdHkiOiJDUklUSUNBTCJ9LHsiY2hlY2siOiJlbnZfZmlsZV9jb21taXR0ZWQiLCJkZXRhaWwiOiJjb21taXRzIGEgLmVudiBmaWxlIiwiZmlsZSI6Ii5lbnYiLCJzZXZlcml0eSI6IkhJR0gifSx7ImNoZWNrIjoidGxzX3ZlcmlmaWNhdGlvbl9kaXNhYmxlZCIsImRldGFpbCI6InR1cm5zIG9mZiBUTFMgY2VydGlmaWNhdGUgY2hlY2tpbmciLCJmaWxlIjoiaW5nZXN0L3MzLnB5IiwibGluZSI6Nywic2V2ZXJpdHkiOiJISUdIIn1dLCJnYXRlIjp7ImRldGVybWluaXN0aWMiOnRydWUsImVuZ2luZSI6ImtleXN0b25lLWNpLTEuMS4wIiwibW9kZWxfaW5fZGVjaXNpb24iOmZhbHNlfSwic2V2ZXJpdHlfY291bnRzIjp7IkNSSVRJQ0FMIjoyLCJISUdIIjoyLCJMT1ciOjAsIk1FRElVTSI6MH0sInNvdXJjZSI6eyJhaV9hZ2VudCI6ZmFsc2UsImF1dGhvciI6ImRldi1pbnRlcm4iLCJwciI6MTI5MCwicmVwbyI6ImFjbWUvaW5nZXN0IiwidGl0bGUiOiJBZGQgUzMgdXBsb2FkIn0sInZlcmRpY3QiOiJCTE9DSyJ9LCJwcmVkaWNhdGVUeXBlIjoiaHR0cHM6Ly9jYWluc3R1ZGlvLm9ubGluZS9rZXlzdG9uZS1jaS9wcmVkaWNhdGUvdjEiLCJzdWJqZWN0IjpbeyJkaWdlc3QiOnsic2hhMjU2IjoiODc4ZmU3YjBmNTIwNzUzZTY1NmQzMmJiZTg3Njg3ZDc2ODMxYjU5YjI4ZGJhY2I2ODU2YTUwMTY1ZDI0Y2I1ZSJ9LCJuYW1lIjoiYWNtZS9pbmdlc3QjMTI5MCJ9XX0=",
    "signatures": [
     {
      "keyid": "SHA256:2232b4add9b35d4016e5be270df4ed56e0dc9b39a0530ac69891073253aae90d",
      "sig": "EYKouHuYLbPRNmDxGJfk4RptoFCh0Mp6gUUZ/Pv76Evr2+tqkVzZywtxUa3OMSl3mCIHRRsWq1F+IYWdJ4ANBw=="
     }
    ]
   }
  }
 },
 {
  "id": "C05",
  "http_status": 200,
  "recorded_at": "2026-11-03T22:46:48+00:00",
  "ms": 56,
  "reply": {
   "verdict": "BLOCK",
   "findings": [
    {
     "check": "malicious_or_typosquat_dependency",
     "severity": "CRITICAL",
     "detail": "pip package 'reqeusts': CAIN-42 supply-chain guard says DENY (TYPOSQUAT)",
     "file": "requirements.txt",
     "line": 3
    },
    {
     "check": "malicious_or_typosquat_dependency",
     "severity": "CRITICAL",
     "detail": "npm package 'lodahs': CAIN-42 supply-chain guard says DENY (TYPOSQUAT)",
     "file": "web/package.json",
     "line": 10
    },
    {
     "check": "untrusted_package_index",
     "severity": "HIGH",
     "detail": "adds a package index other than PyPI",
     "file": "requirements.txt",
     "line": 4
    }
   ],
   "finding_count": 3,
   "severity_counts": {
    "CRITICAL": 2,
    "HIGH": 1,
    "MEDIUM": 0,
    "LOW": 0
   },
   "files_checked": 2,
   "lines_added": 3,
   "lines_removed": 0,
   "diff_sha256": "c237ca03ac9686c9cf77fffba914706fb3ee7fc08b70bfd44bf48e5daca73166",
   "source": {
    "repo": "acme/ml",
    "pr": 57,
    "title": "Add HTTP client and date utils",
    "author": "claude[bot]",
    "ai_agent": true
   },
   "engine_version": "keystone-ci-1.1.0",
   "checked_ms": 18.92,
   "sample_id": "typosquat-deps",
   "title": "Typosquatted packages slipped into dependencies",
   "attestation": {
    "payloadType": "application/vnd.in-toto+json",
    "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJwcmVkaWNhdGUiOnsiY2hlY2tlZF9hdCI6IjIwMjYtMTEtMDNUMjI6NDY6NDhaIiwiZmlsZXNfY2hlY2tlZCI6MiwiZmluZGluZ3MiOlt7ImNoZWNrIjoibWFsaWNpb3VzX29yX3R5cG9zcXVhdF9kZXBlbmRlbmN5IiwiZGV0YWlsIjoicGlwIHBhY2thZ2UgJ3JlcWV1c3RzJzogQ0FJTi00MiBzdXBwbHktY2hhaW4gZ3VhcmQgc2F5cyBERU5ZIChUWVBPU1FVQVQpIiwiZmlsZSI6InJlcXVpcmVtZW50cy50eHQiLCJsaW5lIjozLCJzZXZlcml0eSI6IkNSSVRJQ0FMIn0seyJjaGVjayI6Im1hbGljaW91c19vcl90eXBvc3F1YXRfZGVwZW5kZW5jeSIsImRldGFpbCI6Im5wbSBwYWNrYWdlICdsb2RhaHMnOiBDQUlOLTQyIHN1cHBseS1jaGFpbiBndWFyZCBzYXlzIERFTlkgKFRZUE9TUVVBVCkiLCJmaWxlIjoid2ViL3BhY2thZ2UuanNvbiIsImxpbmUiOjEwLCJzZXZlcml0eSI6IkNSSVRJQ0FMIn0seyJjaGVjayI6InVudHJ1c3RlZF9wYWNrYWdlX2luZGV4IiwiZGV0YWlsIjoiYWRkcyBhIHBhY2thZ2UgaW5kZXggb3RoZXIgdGhhbiBQeVBJIiwiZmlsZSI6InJlcXVpcmVtZW50cy50eHQiLCJsaW5lIjo0LCJzZXZlcml0eSI6IkhJR0gifV0sImdhdGUiOnsiZGV0ZXJtaW5pc3RpYyI6dHJ1ZSwiZW5naW5lIjoia2V5c3RvbmUtY2ktMS4xLjAiLCJtb2RlbF9pbl9kZWNpc2lvbiI6ZmFsc2V9LCJzZXZlcml0eV9jb3VudHMiOnsiQ1JJVElDQUwiOjIsIkhJR0giOjEsIkxPVyI6MCwiTUVESVVNIjowfSwic291cmNlIjp7ImFpX2FnZW50Ijp0cnVlLCJhdXRob3IiOiJjbGF1ZGVbYm90XSIsInByIjo1NywicmVwbyI6ImFjbWUvbWwiLCJ0aXRsZSI6IkFkZCBIVFRQIGNsaWVudCBhbmQgZGF0ZSB1dGlscyJ9LCJ2ZXJkaWN0IjoiQkxPQ0sifSwicHJlZGljYXRlVHlwZSI6Imh0dHBzOi8vY2FpbnN0dWRpby5vbmxpbmUva2V5c3RvbmUtY2kvcHJlZGljYXRlL3YxIiwic3ViamVjdCI6W3siZGlnZXN0Ijp7InNoYTI1NiI6ImMyMzdjYTAzYWM5Njg2YzljZjc3ZmZmYmE5MTQ3MDZmYjNlZTdmYzA4YjcwYmZkNDRiZjQ4ZTVkYWNhNzMxNjYifSwibmFtZSI6ImFjbWUvbWwjNTcifV19",
    "signatures": [
     {
      "keyid": "SHA256:2232b4add9b35d4016e5be270df4ed56e0dc9b39a0530ac69891073253aae90d",
      "sig": "qlu+51LGLxCCDwB9hChCQs03zG2vg3/FzpOSqCbvo67UH+tT7F3WRuVVM7NkpUoGdWmaRtzn4FA3gU6FhWkiBg=="
     }
    ]
   }
  }
 },
 {
  "id": "C06",
  "http_status": 200,
  "recorded_at": "2026-11-03T22:46:49+00:00",
  "ms": 37,
  "reply": {
   "verdict": "BLOCK",
   "findings": [
    {
     "check": "agent_instruction_injection",
     "severity": "CRITICAL",
     "detail": "adds instructions to an AI-agent instruction file that tell agents to skip review, hide actions or move secrets",
     "file": "AGENTS.md",
     "line": 3
    },
    {
     "check": "hidden_unicode",
     "severity": "CRITICAL",
     "detail": "bidirectional-override or invisible tag characters: the code runs differently from how it reads (Trojan Source / ASCII smuggling)",
     "file": "core/access.py",
     "line": 24
    }
   ],
   "finding_count": 2,
   "severity_counts": {
    "CRITICAL": 2,
    "HIGH": 0,
    "MEDIUM": 0,
    "LOW": 0
   },
   "files_checked": 2,
   "lines_added": 6,
   "lines_removed": 0,
   "diff_sha256": "ebfafab4a65962f5c5ff0a5486ac5a30df220056d001921d6bd73b9bcb39081e",
   "source": {
    "repo": "acme/core",
    "pr": 301,
    "title": "docs: agent guidance",
    "author": "contributor-x",
    "ai_agent": false
   },
   "engine_version": "keystone-ci-1.1.0",
   "checked_ms": 0.89,
   "sample_id": "trojan-source",
   "title": "Hidden Unicode + poisoned AGENTS.md",
   "attestation": {
    "payloadType": "application/vnd.in-toto+json",
    "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJwcmVkaWNhdGUiOnsiY2hlY2tlZF9hdCI6IjIwMjYtMTEtMDNUMjI6NDY6NDlaIiwiZmlsZXNfY2hlY2tlZCI6MiwiZmluZGluZ3MiOlt7ImNoZWNrIjoiYWdlbnRfaW5zdHJ1Y3Rpb25faW5qZWN0aW9uIiwiZGV0YWlsIjoiYWRkcyBpbnN0cnVjdGlvbnMgdG8gYW4gQUktYWdlbnQgaW5zdHJ1Y3Rpb24gZmlsZSB0aGF0IHRlbGwgYWdlbnRzIHRvIHNraXAgcmV2aWV3LCBoaWRlIGFjdGlvbnMgb3IgbW92ZSBzZWNyZXRzIiwiZmlsZSI6IkFHRU5UUy5tZCIsImxpbmUiOjMsInNldmVyaXR5IjoiQ1JJVElDQUwifSx7ImNoZWNrIjoiaGlkZGVuX3VuaWNvZGUiLCJkZXRhaWwiOiJiaWRpcmVjdGlvbmFsLW92ZXJyaWRlIG9yIGludmlzaWJsZSB0YWcgY2hhcmFjdGVyczogdGhlIGNvZGUgcnVucyBkaWZmZXJlbnRseSBmcm9tIGhvdyBpdCByZWFkcyAoVHJvamFuIFNvdXJjZSAvIEFTQ0lJIHNtdWdnbGluZykiLCJmaWxlIjoiY29yZS9hY2Nlc3MucHkiLCJsaW5lIjoyNCwic2V2ZXJpdHkiOiJDUklUSUNBTCJ9XSwiZ2F0ZSI6eyJkZXRlcm1pbmlzdGljIjp0cnVlLCJlbmdpbmUiOiJrZXlzdG9uZS1jaS0xLjEuMCIsIm1vZGVsX2luX2RlY2lzaW9uIjpmYWxzZX0sInNldmVyaXR5X2NvdW50cyI6eyJDUklUSUNBTCI6MiwiSElHSCI6MCwiTE9XIjowLCJNRURJVU0iOjB9LCJzb3VyY2UiOnsiYWlfYWdlbnQiOmZhbHNlLCJhdXRob3IiOiJjb250cmlidXRvci14IiwicHIiOjMwMSwicmVwbyI6ImFjbWUvY29yZSIsInRpdGxlIjoiZG9jczogYWdlbnQgZ3VpZGFuY2UifSwidmVyZGljdCI6IkJMT0NLIn0sInByZWRpY2F0ZVR5cGUiOiJodHRwczovL2NhaW5zdHVkaW8ub25saW5lL2tleXN0b25lLWNpL3ByZWRpY2F0ZS92MSIsInN1YmplY3QiOlt7ImRpZ2VzdCI6eyJzaGEyNTYiOiJlYmZhZmFiNGE2NTk2MmY1YzVmZjBhNTQ4NmFjNWEzMGRmMjIwMDU2ZDAwMTkyMWQ2YmQ3M2I5YmNiMzkwODFlIn0sIm5hbWUiOiJhY21lL2NvcmUjMzAxIn1dfQ==",
    "signatures": [
     {
      "keyid": "SHA256:2232b4add9b35d4016e5be270df4ed56e0dc9b39a0530ac69891073253aae90d",
      "sig": "6VrYybGC2xQuDbh/3cB5KtcZe5XO55ul2XKm0O0u8p5fLFEBaypydaBxvtpRIS9OkYlCOpPcfcUomC59WFcaBg=="
     }
    ]
   }
  }
 },
 {
  "id": "C07",
  "http_status": 200,
  "recorded_at": "2026-11-03T22:46:50+00:00",
  "ms": 88,
  "reply": {
   "verdict": "REVIEW",
   "findings": [
    {
     "check": "test_deleted",
     "severity": "HIGH",
     "detail": "deletes a test file",
     "file": "tests/test_auth.py"
    }
   ],
   "finding_count": 1,
   "severity_counts": {
    "CRITICAL": 0,
    "HIGH": 1,
    "MEDIUM": 0,
    "LOW": 0
   },
   "files_checked": 1,
   "lines_added": 0,
   "lines_removed": 2,
   "diff_sha256": "c2de62f038c5c85d07268bcbf5dabe5217a992b58b0b7699056f3de0ae19396f",
   "source": {
    "repo": "lab/demo"
   },
   "engine_version": "keystone-ci-1.1.0",
   "checked_ms": 0.29,
   "attestation": {
    "payloadType": "application/vnd.in-toto+json",
    "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJwcmVkaWNhdGUiOnsiY2hlY2tlZF9hdCI6IjIwMjYtMTEtMDNUMjI6NDY6NTBaIiwiZmlsZXNfY2hlY2tlZCI6MSwiZmluZGluZ3MiOlt7ImNoZWNrIjoidGVzdF9kZWxldGVkIiwiZGV0YWlsIjoiZGVsZXRlcyBhIHRlc3QgZmlsZSIsImZpbGUiOiJ0ZXN0cy90ZXN0X2F1dGgucHkiLCJzZXZlcml0eSI6IkhJR0gifV0sImdhdGUiOnsiZGV0ZXJtaW5pc3RpYyI6dHJ1ZSwiZW5naW5lIjoia2V5c3RvbmUtY2ktMS4xLjAiLCJtb2RlbF9pbl9kZWNpc2lvbiI6ZmFsc2V9LCJzZXZlcml0eV9jb3VudHMiOnsiQ1JJVElDQUwiOjAsIkhJR0giOjEsIkxPVyI6MCwiTUVESVVNIjowfSwic291cmNlIjp7InJlcG8iOiJsYWIvZGVtbyJ9LCJ2ZXJkaWN0IjoiUkVWSUVXIn0sInByZWRpY2F0ZVR5cGUiOiJodHRwczovL2NhaW5zdHVkaW8ub25saW5lL2tleXN0b25lLWNpL3ByZWRpY2F0ZS92MSIsInN1YmplY3QiOlt7ImRpZ2VzdCI6eyJzaGEyNTYiOiJjMmRlNjJmMDM4YzVjODVkMDcyNjhiY2JmNWRhYmU1MjE3YTk5MmI1OGIwYjc2OTkwNTZmM2RlMGFlMTkzOTZmIn0sIm5hbWUiOiJwdWxsLXJlcXVlc3QtZGlmZiJ9XX0=",
    "signatures": [
     {
      "keyid": "SHA256:2232b4add9b35d4016e5be270df4ed56e0dc9b39a0530ac69891073253aae90d",
      "sig": "ZPN8NqtVkFivu3606QBXPIVdYcQEij8Zec8CkvB0UHXtFQwzAh7BuTrUZhc2NATTP9AASCPRQIc/v7zCpIKtAw=="
     }
    ]
   },
   "run_id": "kci-0c91e16e7a8f4d66",
   "record_hash": "409bd73cf51303e236886f6afce5ab244947cea8c98a773b2aa68340f37f4fa8"
  }
 },
 {
  "id": "C08",
  "http_status": 200,
  "recorded_at": "2026-11-03T22:46:51+00:00",
  "ms": 449,
  "reply": {
   "verdict": "BLOCK",
   "findings": [
    {
     "check": "secret_committed",
     "severity": "CRITICAL",
     "detail": "commits a aws access key (AKIA…******); rotate it, the history keeps it",
     "file": "app/settings.py",
     "line": 1
    }
   ],
   "finding_count": 1,
   "severity_counts": {
    "CRITICAL": 1,
    "HIGH": 0,
    "MEDIUM": 0,
    "LOW": 0
   },
   "files_checked": 1,
   "lines_added": 1,
   "lines_removed": 0,
   "diff_sha256": "53e21c122f61a443dabd94e452789a1e27d64a5912943fee029df56b2ef86a3e",
   "source": {
    "repo": "lab/demo"
   },
   "engine_version": "keystone-ci-1.1.0",
   "checked_ms": 0.55,
   "attestation": {
    "payloadType": "application/vnd.in-toto+json",
    "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJwcmVkaWNhdGUiOnsiY2hlY2tlZF9hdCI6IjIwMjYtMTEtMDNUMjI6NDY6NTFaIiwiZmlsZXNfY2hlY2tlZCI6MSwiZmluZGluZ3MiOlt7ImNoZWNrIjoic2VjcmV0X2NvbW1pdHRlZCIsImRldGFpbCI6ImNvbW1pdHMgYSBhd3MgYWNjZXNzIGtleSAoQUtJQeKApioqKioqKik7IHJvdGF0ZSBpdCwgdGhlIGhpc3Rvcnkga2VlcHMgaXQiLCJmaWxlIjoiYXBwL3NldHRpbmdzLnB5IiwibGluZSI6MSwic2V2ZXJpdHkiOiJDUklUSUNBTCJ9XSwiZ2F0ZSI6eyJkZXRlcm1pbmlzdGljIjp0cnVlLCJlbmdpbmUiOiJrZXlzdG9uZS1jaS0xLjEuMCIsIm1vZGVsX2luX2RlY2lzaW9uIjpmYWxzZX0sInNldmVyaXR5X2NvdW50cyI6eyJDUklUSUNBTCI6MSwiSElHSCI6MCwiTE9XIjowLCJNRURJVU0iOjB9LCJzb3VyY2UiOnsicmVwbyI6ImxhYi9kZW1vIn0sInZlcmRpY3QiOiJCTE9DSyJ9LCJwcmVkaWNhdGVUeXBlIjoiaHR0cHM6Ly9jYWluc3R1ZGlvLm9ubGluZS9rZXlzdG9uZS1jaS9wcmVkaWNhdGUvdjEiLCJzdWJqZWN0IjpbeyJkaWdlc3QiOnsic2hhMjU2IjoiNTNlMjFjMTIyZjYxYTQ0M2RhYmQ5NGU0NTI3ODlhMWUyN2Q2NGE1OTEyOTQzZmVlMDI5ZGY1NmIyZWY4NmEzZSJ9LCJuYW1lIjoicHVsbC1yZXF1ZXN0LWRpZmYifV19",
    "signatures": [
     {
      "keyid": "SHA256:2232b4add9b35d4016e5be270df4ed56e0dc9b39a0530ac69891073253aae90d",
      "sig": "hS2oyXVOs0zOzB70NHdvJn0TJtQxOeJsnUSam8dGfDk54EXSDcNbN74EGkjciKrpf6YRXK+hFG/t60Y7ufaRDw=="
     }
    ]
   },
   "run_id": "kci-07dec9bf5ac348e2",
   "record_hash": "2e672272c9f912047d1f124dea29abc0944e0483e2f2c3c7e894e0e615ec7bd2"
  }
 },
 {
  "id": "C09",
  "http_status": 200,
  "recorded_at": "2026-11-03T22:46:51+00:00",
  "ms": 82,
  "reply": {
   "verdict": "REVIEW",
   "findings": [
    {
     "check": "zero_width_characters",
     "severity": "HIGH",
     "detail": "invisible zero-width characters in source",
     "file": "app/acl.py",
     "line": 1
    }
   ],
   "finding_count": 1,
   "severity_counts": {
    "CRITICAL": 0,
    "HIGH": 1,
    "MEDIUM": 0,
    "LOW": 0
   },
   "files_checked": 1,
   "lines_added": 2,
   "lines_removed": 0,
   "diff_sha256": "7d6430a4fed7453c2495fd83fc7b75f8e701379cf09b12cfc95115d163b2b75c",
   "source": {
    "repo": "lab/demo"
   },
   "engine_version": "keystone-ci-1.1.0",
   "checked_ms": 0.43,
   "attestation": {
    "payloadType": "application/vnd.in-toto+json",
    "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJwcmVkaWNhdGUiOnsiY2hlY2tlZF9hdCI6IjIwMjYtMTEtMDNUMjI6NDY6NTFaIiwiZmlsZXNfY2hlY2tlZCI6MSwiZmluZGluZ3MiOlt7ImNoZWNrIjoiemVyb193aWR0aF9jaGFyYWN0ZXJzIiwiZGV0YWlsIjoiaW52aXNpYmxlIHplcm8td2lkdGggY2hhcmFjdGVycyBpbiBzb3VyY2UiLCJmaWxlIjoiYXBwL2FjbC5weSIsImxpbmUiOjEsInNldmVyaXR5IjoiSElHSCJ9XSwiZ2F0ZSI6eyJkZXRlcm1pbmlzdGljIjp0cnVlLCJlbmdpbmUiOiJrZXlzdG9uZS1jaS0xLjEuMCIsIm1vZGVsX2luX2RlY2lzaW9uIjpmYWxzZX0sInNldmVyaXR5X2NvdW50cyI6eyJDUklUSUNBTCI6MCwiSElHSCI6MSwiTE9XIjowLCJNRURJVU0iOjB9LCJzb3VyY2UiOnsicmVwbyI6ImxhYi9kZW1vIn0sInZlcmRpY3QiOiJSRVZJRVcifSwicHJlZGljYXRlVHlwZSI6Imh0dHBzOi8vY2FpbnN0dWRpby5vbmxpbmUva2V5c3RvbmUtY2kvcHJlZGljYXRlL3YxIiwic3ViamVjdCI6W3siZGlnZXN0Ijp7InNoYTI1NiI6IjdkNjQzMGE0ZmVkNzQ1M2MyNDk1ZmQ4M2ZjN2I3NWY4ZTcwMTM3OWNmMDliMTJjZmM5NTExNWQxNjNiMmI3NWMifSwibmFtZSI6InB1bGwtcmVxdWVzdC1kaWZmIn1dfQ==",
    "signatures": [
     {
      "keyid": "SHA256:2232b4add9b35d4016e5be270df4ed56e0dc9b39a0530ac69891073253aae90d",
      "sig": "Fz+ghb6YX+jjfe2IE1np7CoDSEAYrydyQKWNE9SICN56yQQAWBBYkeWupRyr7B/D/Os12MCzadeuJJ/sn9UuBQ=="
     }
    ]
   },
   "run_id": "kci-de28b05fecaa4c22",
   "record_hash": "29be3717ad8f93906ba810650cc64e1e025203d5d918ade5e3dc8f553a6d1876"
  }
 },
 {
  "id": "C10",
  "http_status": 200,
  "recorded_at": "2026-11-03T22:46:52+00:00",
  "ms": 43,
  "reply": {
   "valid": true,
   "problems": [],
   "verdict": "PASS",
   "subject": [
    {
     "digest": {
      "sha256": "dc079582b35e41ba22b71285f1ceed9fda68682db77823dc1f52f54ad1d937f0"
     },
     "name": "acme/payments#415"
    }
   ],
   "bound_to": []
  }
 },
 {
  "id": "C11",
  "http_status": 200,
  "recorded_at": "2026-11-03T22:46:52+00:00",
  "ms": 39,
  "reply": {
   "valid": false,
   "problems": [
    "no signature verifies against the pinned KEYSTONE key"
   ]
  }
 },
 {
  "id": "C12",
  "http_status": 200,
  "recorded_at": "2026-11-03T22:46:53+00:00",
  "ms": 32,
  "reply": {
   "valid": false,
   "problems": [
    "no signature verifies against the pinned KEYSTONE key"
   ]
  }
 },
 {
  "id": "C13",
  "http_status": 200,
  "recorded_at": "2026-11-03T22:46:53+00:00",
  "ms": 42,
  "reply": {
   "valid": false,
   "problems": [
    "payloadType is not application/vnd.in-toto+json"
   ]
  }
 }
]