{
  "schema_version": "1.0.0",
  "scanner": {
    "name": "global-capability-catalog",
    "version": "0.1.0"
  },
  "repo": {
    "id": "github-recent__mbarbine__ja4mlab",
    "name": "mbarbine__ja4mlab",
    "path": "/Users/bwm.barbinewarnermichael/Documents/github/repositories/github-recent/mbarbine__ja4mlab",
    "relative_path": "github-recent/mbarbine__ja4mlab",
    "remote_url": "git@github.com:mbarbine/ja4mlab.git",
    "default_branch": "main",
    "current_commit": "37587dab12e9e017b190bb1fa01b989b1633ca59"
  },
  "languages": [
    {
      "language": "JSON",
      "files": 290,
      "bytes": 14277498
    },
    {
      "language": "Python",
      "files": 15,
      "bytes": 191722
    },
    {
      "language": "Markdown",
      "files": 60,
      "bytes": 155019
    },
    {
      "language": "TypeScript",
      "files": 28,
      "bytes": 28927
    },
    {
      "language": "Shell",
      "files": 17,
      "bytes": 25460
    },
    {
      "language": "JavaScript",
      "files": 1,
      "bytes": 12929
    },
    {
      "language": "YAML",
      "files": 1,
      "bytes": 7826
    },
    {
      "language": "Dockerfile",
      "files": 2,
      "bytes": 893
    },
    {
      "language": "TOML",
      "files": 1,
      "bytes": 77
    }
  ],
  "frameworks": [],
  "packages": {
    "package_manager": "npm",
    "manifests": [
      {
        "path": "packages/shared-fingerprint/package.json",
        "name": "shared-fingerprint",
        "version": "0.1.0",
        "scripts": {},
        "dependencies": {},
        "dev_dependencies": {}
      },
      {
        "path": "packages/shared-http/package.json",
        "name": "shared-http",
        "version": "0.1.0",
        "scripts": {},
        "dependencies": {},
        "dev_dependencies": {}
      },
      {
        "path": "packages/shared-mcp/package.json",
        "name": "shared-mcp",
        "version": "0.1.0",
        "scripts": {},
        "dependencies": {},
        "dev_dependencies": {}
      },
      {
        "path": "packages/shared-scenarios/package.json",
        "name": "shared-scenarios",
        "version": "0.1.0",
        "scripts": {},
        "dependencies": {},
        "dev_dependencies": {}
      }
    ]
  },
  "routes": {
    "api_routes": [],
    "app_routes": []
  },
  "components": [],
  "data_models": [],
  "database": {
    "databases": [],
    "schemas": [],
    "migrations": []
  },
  "tests": [
    {
      "name": "test_network_graph.py",
      "kind": "unit-or-integration",
      "source_path": "tests/contract/test_network_graph.py"
    },
    {
      "name": "test_scenarios_manifest.py",
      "kind": "unit-or-integration",
      "source_path": "tests/contract/test_scenarios_manifest.py"
    },
    {
      "name": "test_service_route_standard.py",
      "kind": "unit-or-integration",
      "source_path": "tests/contract/test_service_route_standard.py"
    },
    {
      "name": "test_v7_agent_ready_plan.py",
      "kind": "unit-or-integration",
      "source_path": "tests/contract/test_v7_agent_ready_plan.py"
    },
    {
      "name": "test_capture_bundle.py",
      "kind": "unit-or-integration",
      "source_path": "tests/integration/test_capture_bundle.py"
    },
    {
      "name": "test_full_trace_smoke.py",
      "kind": "unit-or-integration",
      "source_path": "tests/integration/test_full_trace_smoke.py"
    },
    {
      "name": "test_openclaw_xai_smoke.py",
      "kind": "unit-or-integration",
      "source_path": "tests/integration/test_openclaw_xai_smoke.py"
    },
    {
      "name": "test_repo_docs.py",
      "kind": "unit-or-integration",
      "source_path": "tests/integration/test_repo_docs.py"
    },
    {
      "name": "test_compose.py",
      "kind": "unit-or-integration",
      "source_path": "tests/unit/test_compose.py"
    },
    {
      "name": "test_shared_package_layout.py",
      "kind": "unit-or-integration",
      "source_path": "tests/unit/test_shared_package_layout.py"
    }
  ],
  "ci": {
    "workflows": []
  },
  "containers": {
    "dockerfiles": [
      {
        "path": "services/api-broker/Dockerfile"
      },
      {
        "path": "services/openclaw-runtime/Dockerfile"
      }
    ],
    "compose_files": [
      {
        "path": "compose/docker-compose.yml"
      }
    ]
  },
  "env": {
    "example_files": [],
    "variables": [
      {
        "name": "JA4MLAB_GATEWAY_HOST",
        "source_paths": [
          "services/api-broker/server.mjs"
        ],
        "likely_secret": false
      },
      {
        "name": "MCP_PROTOCOL_VERSION",
        "source_paths": [
          "services/api-broker/server.mjs"
        ],
        "likely_secret": false
      },
      {
        "name": "NODE_ENV",
        "source_paths": [
          "packages/shared-http/src/health.ts"
        ],
        "likely_secret": false
      },
      {
        "name": "PORT",
        "source_paths": [
          "services/api-broker/server.mjs"
        ],
        "likely_secret": false
      },
      {
        "name": "VERCEL_GIT_COMMIT_SHA",
        "source_paths": [
          "packages/shared-http/src/version.ts"
        ],
        "likely_secret": false
      }
    ]
  },
  "configs": [
    {
      "path": "compose/docker-compose.yml"
    },
    {
      "path": "packages/shared-fingerprint/package.json"
    },
    {
      "path": "packages/shared-http/package.json"
    },
    {
      "path": "packages/shared-mcp/package.json"
    },
    {
      "path": "packages/shared-scenarios/package.json"
    }
  ],
  "docs": {
    "readme_paths": [
      {
        "path": "delivery artifacts/README.md"
      },
      {
        "path": "docs/README.md"
      },
      {
        "path": "README.md"
      },
      {
        "path": "review/ja4m-security-review/README.md"
      }
    ],
    "doc_paths": [
      {
        "path": "docs/ARCHITECTURE.md"
      },
      {
        "path": "docs/CAPTURE_BUNDLE_CONTRACT.md"
      },
      {
        "path": "docs/CAPTURE.md"
      },
      {
        "path": "docs/DISCOVERABILITY_CONTRACT.md"
      },
      {
        "path": "docs/IMPLEMENTATION_PLAN.md"
      },
      {
        "path": "docs/INSTALL.md"
      },
      {
        "path": "docs/JA4M_LAB_V7_AGENT_READY_PLAN.md"
      },
      {
        "path": "docs/ja4m_mcp_example_v2_README.md"
      },
      {
        "path": "docs/JA4M_PCAP_TESTING_GUIDANCE.md"
      },
      {
        "path": "docs/NETWORK_DISCOVERY.md"
      },
      {
        "path": "docs/OPENCLAW_MODEL.md"
      },
      {
        "path": "docs/OPENDOCS_MODEL.md"
      },
      {
        "path": "docs/README.md"
      },
      {
        "path": "docs/REPORTING.md"
      },
      {
        "path": "docs/SCENARIO_MATRIX.md"
      },
      {
        "path": "docs/SCENARIOS.md"
      },
      {
        "path": "docs/SERVICE_CONTRACTS.md"
      },
      {
        "path": "docs/V7_MISSING_FROM_THIS_REPO.md"
      },
      {
        "path": "docs/V7_PROMPT_PACK.md"
      }
    ],
    "llms_context_paths": []
  },
  "discovery_files": {
    "openapi": [],
    "mcp": [],
    "llms": [],
    "sitemaps": [],
    "feeds": [],
    "well_known": [],
    "robots": [],
    "manifests": []
  },
  "integrations": [
    {
      "name": "Vercel",
      "confidence": "medium",
      "evidence_paths": [
        "packages/shared-fingerprint/package.json",
        "packages/shared-http/package.json",
        "packages/shared-http/src/version.ts",
        "packages/shared-mcp/package.json",
        "packages/shared-scenarios/package.json"
      ]
    }
  ],
  "license": {
    "spdx": null,
    "paths": []
  },
  "comments": [
    {
      "kind": "security",
      "source_path": "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/validation/declared-vs-actual.json",
      "line": 205,
      "text": "\"security\": ["
    },
    {
      "kind": "security",
      "source_path": "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/validation/declared-vs-actual.json",
      "line": 218,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/validation/declared-vs-actual.json",
      "line": 314,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/validation/declared-vs-actual.json",
      "line": 447,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/validation/declared-vs-actual.json",
      "line": 535,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/validation/declared-vs-actual.json",
      "line": 588,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/validation/declared-vs-actual.json",
      "line": 680,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/validation/declared-vs-actual.json",
      "line": 752,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/validation/declared-vs-actual.json",
      "line": 846,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/validation/declared-vs-actual.json",
      "line": 1287,
      "text": "\"body\": \"8000\\r\\n{\\\"ok\\\":true,\\\"data\\\":{\\\"mcpClientSubject\\\":\\\"api-broker.lab\\\",\\\"discovery\\\":[{\\\"ok\\\":true,\\\"status\\\":200,\\\"headers\\\":{\\\"access-control-allow-headers\\\":\\\"Content-Type, Authorization\\\",\\\"access-control-allow-methods\\\":\\\"GET,"
    },
    {
      "kind": "security",
      "source_path": "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/validation/declared-vs-actual.json",
      "line": 1303,
      "text": "\"body\": \"8000\\r\\n{\\\"ok\\\":true,\\\"data\\\":{\\\"acp\\\":true,\\\"mcpClientSubject\\\":\\\"api-broker.lab\\\",\\\"result\\\":{\\\"lifecycle\\\":{\\\"init\\\":{\\\"ok\\\":true,\\\"status\\\":200,\\\"headers\\\":{\\\"access-control-allow-headers\\\":\\\"X-Requested-With, Content-Type, Aut"
    },
    {
      "kind": "security",
      "source_path": "delivery artifacts/technical-evidence/scenarios/02-human-originated-agent-chain/validation/declared-vs-actual.json",
      "line": 188,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "delivery artifacts/technical-evidence/scenarios/02-human-originated-agent-chain/validation/declared-vs-actual.json",
      "line": 201,
      "text": "\"body\": \"8000\\r\\n<!doctype html>\\n<html lang=\\\"%sveltekit.lang%\\\" dir=\\\"%sveltekit.dir%\\\">\\n  <head>\\n    <!-- Meta Information -->\\n    <meta charset=\\\"utf-8\\\" />\\n    <meta\\n      name=\\\"viewport\\\"\\n      content=\\\"width=device-width, ini"
    },
    {
      "kind": "security",
      "source_path": "delivery artifacts/technical-evidence/scenarios/02-human-originated-agent-chain/validation/declared-vs-actual.json",
      "line": 246,
      "text": "\"security\": ["
    },
    {
      "kind": "security",
      "source_path": "delivery artifacts/technical-evidence/scenarios/02-human-originated-agent-chain/validation/declared-vs-actual.json",
      "line": 259,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "delivery artifacts/technical-evidence/scenarios/02-human-originated-agent-chain/validation/declared-vs-actual.json",
      "line": 355,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "delivery artifacts/technical-evidence/scenarios/02-human-originated-agent-chain/validation/declared-vs-actual.json",
      "line": 488,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "delivery artifacts/technical-evidence/scenarios/02-human-originated-agent-chain/validation/declared-vs-actual.json",
      "line": 576,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "delivery artifacts/technical-evidence/scenarios/02-human-originated-agent-chain/validation/declared-vs-actual.json",
      "line": 629,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "delivery artifacts/technical-evidence/scenarios/02-human-originated-agent-chain/validation/declared-vs-actual.json",
      "line": 721,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "delivery artifacts/technical-evidence/scenarios/02-human-originated-agent-chain/validation/declared-vs-actual.json",
      "line": 793,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "delivery artifacts/technical-evidence/scenarios/02-human-originated-agent-chain/validation/declared-vs-actual.json",
      "line": 887,
      "text": "\"security\": [],"
    },
    {
      "kind": "unsafe",
      "source_path": "delivery artifacts/technical-evidence/scenarios/02-human-originated-agent-chain/validation/declared-vs-actual.json",
      "line": 1985,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: blob:; font-src 'self' data:; connect-src 'self' wss: https: ws:; frame-ancestors"
    },
    {
      "kind": "security",
      "source_path": "delivery artifacts/technical-evidence/scenarios/02-human-originated-agent-chain/validation/declared-vs-actual.json",
      "line": 1992,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "delivery artifacts/technical-evidence/scenarios/02-human-originated-agent-chain/validation/declared-vs-actual.json",
      "line": 2099,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: blob:; font-src 'self' data:; connect-src 'self' wss: https: ws:; frame-ancestors"
    },
    {
      "kind": "security",
      "source_path": "delivery artifacts/technical-evidence/scenarios/02-human-originated-agent-chain/validation/declared-vs-actual.json",
      "line": 2106,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "delivery artifacts/technical-evidence/scenarios/02-human-originated-agent-chain/validation/declared-vs-actual.json",
      "line": 2145,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: blob:; font-src 'self' data:; connect-src 'self' wss: https: ws:; frame-ancestors"
    },
    {
      "kind": "security",
      "source_path": "delivery artifacts/technical-evidence/scenarios/02-human-originated-agent-chain/validation/declared-vs-actual.json",
      "line": 2152,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "delivery artifacts/technical-evidence/scenarios/03-final-exhaustive-tls/validation/declared-vs-actual.json",
      "line": 6893,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://vercel.live https://*.vercel.app; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.c"
    },
    {
      "kind": "security",
      "source_path": "delivery artifacts/technical-evidence/scenarios/03-final-exhaustive-tls/validation/declared-vs-actual.json",
      "line": 6898,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "delivery artifacts/technical-evidence/scenarios/03-final-exhaustive-tls/validation/declared-vs-actual.json",
      "line": 6939,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://vercel.live https://*.vercel.app; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.c"
    },
    {
      "kind": "security",
      "source_path": "delivery artifacts/technical-evidence/scenarios/03-final-exhaustive-tls/validation/declared-vs-actual.json",
      "line": 6944,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "delivery artifacts/technical-evidence/scenarios/03-final-exhaustive-tls/validation/declared-vs-actual.json",
      "line": 6985,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://vercel.live https://*.vercel.app; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.c"
    },
    {
      "kind": "security",
      "source_path": "delivery artifacts/technical-evidence/scenarios/03-final-exhaustive-tls/validation/declared-vs-actual.json",
      "line": 6990,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "delivery artifacts/technical-evidence/scenarios/03-final-exhaustive-tls/validation/declared-vs-actual.json",
      "line": 7923,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://vercel.live https://*.vercel.app; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.c"
    },
    {
      "kind": "security",
      "source_path": "delivery artifacts/technical-evidence/scenarios/03-final-exhaustive-tls/validation/declared-vs-actual.json",
      "line": 7928,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "delivery artifacts/technical-evidence/scenarios/03-final-exhaustive-tls/validation/declared-vs-actual.json",
      "line": 8002,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://vercel.live https://*.vercel.app; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.c"
    },
    {
      "kind": "security",
      "source_path": "delivery artifacts/technical-evidence/scenarios/03-final-exhaustive-tls/validation/declared-vs-actual.json",
      "line": 8007,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "delivery artifacts/technical-evidence/scenarios/03-final-exhaustive-tls/validation/declared-vs-actual.json",
      "line": 8035,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://vercel.live https://*.vercel.app; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.c"
    },
    {
      "kind": "security",
      "source_path": "delivery artifacts/technical-evidence/scenarios/03-final-exhaustive-tls/validation/declared-vs-actual.json",
      "line": 8040,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "delivery artifacts/technical-evidence/scenarios/03-final-exhaustive-tls/validation/declared-vs-actual.json",
      "line": 8068,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://vercel.live https://*.vercel.app; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.c"
    },
    {
      "kind": "security",
      "source_path": "delivery artifacts/technical-evidence/scenarios/03-final-exhaustive-tls/validation/declared-vs-actual.json",
      "line": 8073,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "delivery artifacts/technical-evidence/scenarios/03-final-exhaustive-tls/validation/declared-vs-actual.json",
      "line": 8101,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://vercel.live https://*.vercel.app; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.c"
    },
    {
      "kind": "security",
      "source_path": "delivery artifacts/technical-evidence/scenarios/03-final-exhaustive-tls/validation/declared-vs-actual.json",
      "line": 8106,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "diagnostics/ACTION_PLAN.md",
      "line": 110,
      "text": "`review/ja4m-security-review`."
    },
    {
      "kind": "security",
      "source_path": "docs/IMPLEMENTATION_PLAN.md",
      "line": 19,
      "text": "`review/ja4m-security-review/captures/final-exhaustive-tls/`."
    },
    {
      "kind": "security",
      "source_path": "docs/INSTALL.md",
      "line": 93,
      "text": "The reviewer-facing package lives under `review/ja4m-security-review/` after it"
    },
    {
      "kind": "security",
      "source_path": "docs/REPORTING.md",
      "line": 4,
      "text": "inspection. The security reviewer should be able to evaluate JA4M-C and JA4M-S"
    },
    {
      "kind": "security",
      "source_path": "docs/REPORTING.md",
      "line": 69,
      "text": "`review/ja4m-security-review/` is the PCAP-first handoff folder. It should"
    },
    {
      "kind": "security",
      "source_path": "README.md",
      "line": 19,
      "text": "`review/ja4m-security-review/`; start with"
    },
    {
      "kind": "security",
      "source_path": "README.md",
      "line": 20,
      "text": "`review/ja4m-security-review/PCAP_REVIEW_GUIDE.md` for PCAP-only review."
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/README.md",
      "line": 1,
      "text": "# JA4M Security Review Package"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/REVIEW_MANIFEST.json",
      "line": 2,
      "text": "\"name\": \"ja4m-security-review\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/REVIEW_MANIFEST.json",
      "line": 4,
      "text": "\"purpose\": \"Security review package for JA4M-C and JA4M-S hostile agent detection research.\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 118,
      "text": "\"security\": ["
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 131,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 227,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 360,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 448,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 501,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 593,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 665,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 759,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 1208,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 1214,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 1266,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 1271,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 1305,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 1310,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 2622,
      "text": "\"description\": \"Query CLAWS (claws.platphormnews.com) security intelligence platform for threat data and policy information.\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 2734,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 2739,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 2872,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 2877,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 3245,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 3250,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 3318,
      "text": "\"security\": ["
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 3331,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 3427,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 3560,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 3648,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 3701,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 3793,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 3865,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 3959,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 4326,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 4331,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 5643,
      "text": "\"description\": \"Query CLAWS (claws.platphormnews.com) security intelligence platform for threat data and policy information.\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 5758,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 5763,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 5800,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: blob:; font-src 'self' data:; connect-src 'self' wss: https: ws:; frame-ancestors"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
      "line": 5807,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 118,
      "text": "\"security\": ["
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 131,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 227,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 360,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 448,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 501,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 593,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 665,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 759,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 1209,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 1215,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 1267,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 1272,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 1306,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 1311,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 2622,
      "text": "\"description\": \"Query CLAWS (claws.platphormnews.com) security intelligence platform for threat data and policy information.\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 2735,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 2740,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 2873,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 2878,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 3246,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 3251,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 3318,
      "text": "\"security\": ["
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 3331,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 3427,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 3560,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 3648,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 3701,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 3793,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 3865,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 3959,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 4327,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 4332,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 5643,
      "text": "\"description\": \"Query CLAWS (claws.platphormnews.com) security intelligence platform for threat data and policy information.\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 5759,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 5764,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 5801,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: blob:; font-src 'self' data:; connect-src 'self' wss: https: ws:; frame-ancestors"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
      "line": 5808,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 306,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://vercel.live https://*.vercel.app; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.c"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 311,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 352,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://vercel.live https://*.vercel.app; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.c"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 357,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 398,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://vercel.live https://*.vercel.app; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.c"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 403,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 1336,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://vercel.live https://*.vercel.app; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.c"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 1341,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 1415,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://vercel.live https://*.vercel.app; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.c"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 1420,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 1448,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://vercel.live https://*.vercel.app; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.c"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 1453,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 1481,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://vercel.live https://*.vercel.app; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.c"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 1486,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 1514,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://vercel.live https://*.vercel.app; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.c"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 1519,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 2214,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://vercel.live https://*.vercel.app; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.c"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 2219,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 2253,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://vercel.live https://*.vercel.app; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.c"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 2258,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 2300,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://vercel.live https://*.vercel.app; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.c"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 2305,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 2368,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://vercel.live https://*.vercel.app; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.c"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 2373,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 2394,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://vercel.live https://*.vercel.app; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.c"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 2399,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 2411,
      "text": "\"body\": \"<?xml version=\\\"1.0\\\" encoding=\\\"UTF-8\\\"?>\\n<urlset xmlns=\\\"http://www.sitemaps.org/schemas/sitemap/0.9\\\">\\n<url>\\n<loc>https://calendar.platphormnews.com</loc>\\n<lastmod>2026-05-08T23:42:21.479Z</lastmod>\\n<changefreq>daily</chang"
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 2421,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://vercel.live https://*.vercel.app; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.c"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 2426,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 2558,
      "text": "\"security\": ["
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 2571,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 2667,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 2800,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 2888,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 2941,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 3033,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 3105,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 3199,
      "text": "\"security\": [],"
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 5629,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://va.vercel-scripts.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: blob:; font-src 'self' data:; connect-src 'self' ws"
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 5878,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://va.vercel-scripts.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: blob:; font-src 'self' data:; connect-src 'self' ws"
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 5931,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://va.vercel-scripts.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: blob:; font-src 'self' data:; connect-src 'self' ws"
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 6005,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://va.vercel-scripts.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: blob:; font-src 'self' data:; connect-src 'self' ws"
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 6034,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://va.vercel-scripts.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: blob:; font-src 'self' data:; connect-src 'self' ws"
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 6064,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://va.vercel-scripts.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: blob:; font-src 'self' data:; connect-src 'self' ws"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 6098,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 6103,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 6165,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 6170,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 6232,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 6237,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 6277,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 6282,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 6322,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
      "line": 6327,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/ide-profiles/declared-vs-actual.json",
      "line": 25,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/ide-profiles/declared-vs-actual.json",
      "line": 30,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/ide-profiles/declared-vs-actual.json",
      "line": 94,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/ide-profiles/declared-vs-actual.json",
      "line": 100,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/ide-profiles/declared-vs-actual.json",
      "line": 152,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/ide-profiles/declared-vs-actual.json",
      "line": 157,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/ide-profiles/declared-vs-actual.json",
      "line": 191,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/ide-profiles/declared-vs-actual.json",
      "line": 196,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/ide-profiles/declared-vs-actual.json",
      "line": 1508,
      "text": "\"description\": \"Query CLAWS (claws.platphormnews.com) security intelligence platform for threat data and policy information.\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/ide-profiles/declared-vs-actual.json",
      "line": 1620,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/ide-profiles/declared-vs-actual.json",
      "line": 1625,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/ide-profiles/declared-vs-actual.json",
      "line": 1663,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/ide-profiles/declared-vs-actual.json",
      "line": 1669,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/ide-profiles/declared-vs-actual.json",
      "line": 1721,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/ide-profiles/declared-vs-actual.json",
      "line": 1726,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/ide-profiles/declared-vs-actual.json",
      "line": 1760,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/ide-profiles/declared-vs-actual.json",
      "line": 1765,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/ide-profiles/declared-vs-actual.json",
      "line": 3077,
      "text": "\"description\": \"Query CLAWS (claws.platphormnews.com) security intelligence platform for threat data and policy information.\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/ide-profiles/declared-vs-actual.json",
      "line": 3189,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/ide-profiles/declared-vs-actual.json",
      "line": 3194,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/ide-profiles/declared-vs-actual.json",
      "line": 3232,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/ide-profiles/declared-vs-actual.json",
      "line": 3238,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/ide-profiles/declared-vs-actual.json",
      "line": 3290,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/ide-profiles/declared-vs-actual.json",
      "line": 3295,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/ide-profiles/declared-vs-actual.json",
      "line": 3329,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/ide-profiles/declared-vs-actual.json",
      "line": 3334,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/ide-profiles/declared-vs-actual.json",
      "line": 4646,
      "text": "\"description\": \"Query CLAWS (claws.platphormnews.com) security intelligence platform for threat data and policy information.\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/ide-profiles/declared-vs-actual.json",
      "line": 4758,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/ide-profiles/declared-vs-actual.json",
      "line": 4763,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/ide-profiles/declared-vs-actual.json",
      "line": 4798,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: blob:; font-src 'self' data:; connect-src 'self' wss: https: ws:; frame-ancestors"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/ide-profiles/declared-vs-actual.json",
      "line": 4805,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 100,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 106,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 160,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 166,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 220,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 226,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 279,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 284,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 319,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 324,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 1636,
      "text": "\"description\": \"Query CLAWS (claws.platphormnews.com) security intelligence platform for threat data and policy information.\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 1749,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 1754,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 1789,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 1794,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 3106,
      "text": "\"description\": \"Query CLAWS (claws.platphormnews.com) security intelligence platform for threat data and policy information.\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 3219,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 3224,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 3259,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 3264,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 4576,
      "text": "\"description\": \"Query CLAWS (claws.platphormnews.com) security intelligence platform for threat data and policy information.\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 4720,
      "text": "\"security\": ["
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 4733,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 4829,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 4962,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 5050,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 5103,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 5195,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 5267,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 5361,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 5768,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 5773,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 5811,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 5816,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 5854,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 5859,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 5897,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 5902,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 5941,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 5946,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 5959,
      "text": "\"body\": \"{\\\"name\\\":\\\"platphormnews-mcp\\\",\\\"version\\\":\\\"0.1.0\\\",\\\"protocol\\\":\\\"mcp\\\",\\\"protocolVersion\\\":\\\"2024-11-05\\\",\\\"transport\\\":\\\"streamable-http\\\",\\\"endpoint\\\":\\\"https://mcp.platphormnews.com/api/mcp\\\",\\\"capabilities\\\":{\\\"tools\\\":{\\\"c"
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 5969,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: blob:; font-src 'self' data:; connect-src 'self' wss: https: ws:; frame-ancestors"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
      "line": 5976,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 101,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 107,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 161,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 167,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 221,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 227,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 280,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 285,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 320,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 325,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 1636,
      "text": "\"description\": \"Query CLAWS (claws.platphormnews.com) security intelligence platform for threat data and policy information.\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 1750,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 1755,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 1790,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 1795,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 3106,
      "text": "\"description\": \"Query CLAWS (claws.platphormnews.com) security intelligence platform for threat data and policy information.\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 3220,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 3225,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 3260,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 3265,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 4576,
      "text": "\"description\": \"Query CLAWS (claws.platphormnews.com) security intelligence platform for threat data and policy information.\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 4720,
      "text": "\"security\": ["
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 4733,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 4829,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 4962,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 5050,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 5103,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 5195,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 5267,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 5361,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 5769,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 5774,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 5812,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 5817,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 5855,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 5860,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 5898,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 5903,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 5942,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 5947,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 5959,
      "text": "\"body\": \"{\\\"name\\\":\\\"platphormnews-mcp\\\",\\\"version\\\":\\\"0.1.0\\\",\\\"protocol\\\":\\\"mcp\\\",\\\"protocolVersion\\\":\\\"2024-11-05\\\",\\\"transport\\\":\\\"streamable-http\\\",\\\"endpoint\\\":\\\"https://mcp.platphormnews.com/api/mcp\\\",\\\"capabilities\\\":{\\\"tools\\\":{\\\"c"
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 5970,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: blob:; font-src 'self' data:; connect-src 'self' wss: https: ws:; frame-ancestors"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
      "line": 5977,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/openclaw-integration-http/declared-vs-actual.json",
      "line": 1964,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: blob:; font-src 'self' data:; connect-src 'self' wss: https: ws:; frame-ancestors"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/openclaw-integration-http/declared-vs-actual.json",
      "line": 1971,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/openclaw-integration-tls/declared-vs-actual.json",
      "line": 1976,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: blob:; font-src 'self' data:; connect-src 'self' wss: https: ws:; frame-ancestors"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/openclaw-integration-tls/declared-vs-actual.json",
      "line": 1983,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/openclaw-runtime-http/declared-vs-actual.json",
      "line": 218,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: blob:; font-src 'self' data:; connect-src 'self' wss: https: ws:; frame-ancestors"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/openclaw-runtime-http/declared-vs-actual.json",
      "line": 225,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/openclaw-runtime-tls/declared-vs-actual.json",
      "line": 219,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: blob:; font-src 'self' data:; connect-src 'self' wss: https: ws:; frame-ancestors"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/openclaw-runtime-tls/declared-vs-actual.json",
      "line": 226,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 28,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 75,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 1654,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 2017,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 2133,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 2777,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 2782,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 2842,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 2847,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 2883,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 2888,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 2926,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 2931,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 2983,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 2988,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 3022,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 3027,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 3087,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 3092,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 3147,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self';\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 3152,
      "text": "\"Strict-Transport-Security\": \"max-age=63072000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 3184,
      "text": "\"security\": {"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 3309,
      "text": "\"security\": ["
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 3322,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 3418,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 3551,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 3639,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 3692,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 3784,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 3856,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 3950,
      "text": "\"security\": [],"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 4409,
      "text": "\"security\": \"security@platphormnews.com\""
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 4477,
      "text": "\"security_txt\": \"https://docs.platphormnews.com/.well-known/security.txt\","
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 4698,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: blob:; font-src 'self' data:; connect-src 'self' wss: https: ws:; frame-ancestors"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 4705,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 5589,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://vercel.live https://*.vercel.app; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.c"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 5594,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 5633,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://vercel.live https://*.vercel.app; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.c"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 5638,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 6569,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://vercel.live https://*.vercel.app; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.c"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 6574,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 6606,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://vercel.live https://*.vercel.app; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.c"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 6611,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 6643,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://vercel.live https://*.vercel.app; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.c"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 6648,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 6680,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://vercel.live https://*.vercel.app; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.c"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 6685,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 6743,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://vercel.live https://*.vercel.app; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.c"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 6748,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "unsafe",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 6801,
      "text": "\"Content-Security-Policy\": \"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://vercel.live https://*.vercel.app; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.c"
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
      "line": 6806,
      "text": "\"Strict-Transport-Security\": \"max-age=31536000; includeSubDomains; preload\","
    },
    {
      "kind": "security",
      "source_path": "review/ja4m-security-review/WHITEPAPER.md",
      "line": 215,
      "text": "The current artifacts are sufficient for a security expert to review the"
    },
    {
      "kind": "security",
      "source_path": "services/openclaw-runtime/bin/entrypoint.sh",
      "line": 76,
      "text": "This runtime is dedicated to PlatPhormNews JA4M security testing."
    },
    {
      "kind": "security",
      "source_path": "tests/integration/test_capture_bundle.py",
      "line": 63,
      "text": "base = Path(\"review/ja4m-security-review\")"
    },
    {
      "kind": "security",
      "source_path": "tests/integration/test_capture_bundle.py",
      "line": 76,
      "text": "guide = Path(\"review/ja4m-security-review/PCAP_REVIEW_GUIDE.md\").read_text()"
    }
  ],
  "security": {
    "secret_risks": [],
    "unsafe_patterns": [],
    "sensitive_data_indicators": [
      {
        "name": "api_key",
        "confidence": "medium",
        "evidence_paths": [
          "compose/docker-compose.yml",
          "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/validation/declared-vs-actual.json",
          "diagnostics/ACTION_PLAN.md",
          "docs/DISCOVERABILITY_CONTRACT.md",
          "docs/SERVICE_CONTRACTS.md",
          "packages/shared-http/src/llms.ts",
          "packages/shared-http/src/routes.ts",
          "README.md",
          "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
          "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
          "scripts/run-openclaw-xai-smoke.sh",
          "scripts/verify-delivery-artifacts.py",
          "services/api-broker/server.mjs",
          "services/openclaw-runtime/bin/entrypoint.sh",
          "tests/integration/test_openclaw_xai_smoke.py",
          "tests/unit/test_shared_package_layout.py"
        ]
      },
      {
        "name": "card",
        "confidence": "medium",
        "evidence_paths": [
          "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/validation/declared-vs-actual.json",
          "delivery artifacts/technical-evidence/scenarios/02-human-originated-agent-chain/validation/declared-vs-actual.json",
          "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json"
        ]
      },
      {
        "name": "email",
        "confidence": "medium",
        "evidence_paths": [
          "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/validation/declared-vs-actual.json",
          "delivery artifacts/technical-evidence/scenarios/02-human-originated-agent-chain/validation/declared-vs-actual.json",
          "delivery artifacts/technical-evidence/scenarios/03-final-exhaustive-tls/validation/declared-vs-actual.json",
          "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
          "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
          "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
          "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
          "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
          "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
          "tools/pcap/gen_mcp_pcap_complete.py"
        ]
      },
      {
        "name": "financial",
        "confidence": "medium",
        "evidence_paths": [
          "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/validation/declared-vs-actual.json"
        ]
      },
      {
        "name": "fingerprint",
        "confidence": "medium",
        "evidence_paths": [
          "ACCEPTANCE_CRITERIA.md",
          "capture/scripts/build-summary.sh",
          "delivery artifacts/high-level/ASSESSMENT.md",
          "delivery artifacts/high-level/WHY_JA4M.md",
          "delivery artifacts/MANIFEST.json",
          "delivery artifacts/README.md",
          "delivery artifacts/technical-evidence/glossary/GLOSSARY.md",
          "delivery artifacts/technical-evidence/review-notes/GAPS_AND_LIMITATIONS.md",
          "delivery artifacts/technical-evidence/review-notes/PCAP_REVIEW_GUIDE.md",
          "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/fingerprints/aggregate/ja4.json",
          "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/fingerprints/aggregate/ja4h.json",
          "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/fingerprints/aggregate/ja4l.json",
          "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/fingerprints/aggregate/ja4m-c.json",
          "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/fingerprints/aggregate/ja4m-s.json",
          "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/fingerprints/aggregate/ja4m-x.json",
          "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/fingerprints/aggregate/ja4s.json",
          "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/fingerprints/aggregate/ja4t.json",
          "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/fingerprints/by-leg/agent-to-acp/ja4.json",
          "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/fingerprints/by-leg/agent-to-acp/ja4h.json",
          "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/fingerprints/by-leg/agent-to-acp/ja4l.json"
        ]
      },
      {
        "name": "health",
        "confidence": "medium",
        "evidence_paths": [
          "ACCEPTANCE_CRITERIA.md",
          "compose/docker-compose.yml",
          "delivery artifacts/high-level/WHY_JA4M.md",
          "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/fingerprints/aggregate/ja4m-c.json",
          "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/fingerprints/aggregate/ja4m-s.json",
          "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/fingerprints/aggregate/ja4m-x.json",
          "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/fingerprints/by-leg/api-to-mcp/ja4m-c.json",
          "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/fingerprints/by-leg/api-to-mcp/ja4m-s.json",
          "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/fingerprints/by-leg/api-to-mcp/ja4m-x.json",
          "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/groupings.json",
          "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/validation/declared-vs-actual.json",
          "delivery artifacts/technical-evidence/scenarios/02-human-originated-agent-chain/validation/declared-vs-actual.json",
          "delivery artifacts/technical-evidence/scenarios/03-final-exhaustive-tls/fingerprints/aggregate/ja4m-c.json",
          "delivery artifacts/technical-evidence/scenarios/03-final-exhaustive-tls/fingerprints/aggregate/ja4m-s.json",
          "delivery artifacts/technical-evidence/scenarios/03-final-exhaustive-tls/fingerprints/aggregate/ja4m-x.json",
          "delivery artifacts/technical-evidence/scenarios/03-final-exhaustive-tls/fingerprints/by-leg/api-to-mcp/ja4m-c.json",
          "delivery artifacts/technical-evidence/scenarios/03-final-exhaustive-tls/fingerprints/by-leg/api-to-mcp/ja4m-s.json",
          "delivery artifacts/technical-evidence/scenarios/03-final-exhaustive-tls/fingerprints/by-leg/api-to-mcp/ja4m-x.json",
          "delivery artifacts/technical-evidence/scenarios/03-final-exhaustive-tls/groupings.json",
          "delivery artifacts/technical-evidence/scenarios/03-final-exhaustive-tls/summary.md"
        ]
      },
      {
        "name": "location",
        "confidence": "medium",
        "evidence_paths": [
          "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/validation/declared-vs-actual.json",
          "delivery artifacts/technical-evidence/scenarios/02-human-originated-agent-chain/validation/declared-vs-actual.json",
          "delivery artifacts/technical-evidence/scenarios/03-final-exhaustive-tls/validation/declared-vs-actual.json",
          "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
          "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
          "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
          "review/ja4m-security-review/validation/ide-profiles/declared-vs-actual.json",
          "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
          "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
          "review/ja4m-security-review/validation/openclaw-integration-http/declared-vs-actual.json",
          "review/ja4m-security-review/validation/openclaw-integration-tls/declared-vs-actual.json",
          "review/ja4m-security-review/validation/openclaw-runtime-http/declared-vs-actual.json",
          "review/ja4m-security-review/validation/openclaw-runtime-tls/declared-vs-actual.json",
          "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
          "tests/integration/test_capture_bundle.py"
        ]
      },
      {
        "name": "password",
        "confidence": "medium",
        "evidence_paths": [
          "compose/docker-compose.yml",
          "delivery artifacts/technical-evidence/scenarios/02-human-originated-agent-chain/validation/declared-vs-actual.json",
          "review/ja4m-security-review/validation/openclaw-runtime-http/declared-vs-actual.json",
          "review/ja4m-security-review/validation/openclaw-runtime-tls/declared-vs-actual.json"
        ]
      },
      {
        "name": "payment",
        "confidence": "medium",
        "evidence_paths": [
          "delivery artifacts/technical-evidence/scenarios/02-human-originated-agent-chain/validation/declared-vs-actual.json"
        ]
      },
      {
        "name": "token",
        "confidence": "medium",
        "evidence_paths": [
          "compose/docker-compose.yml",
          "delivery artifacts/technical-evidence/scenarios/01-api-broker-mediated-ja4m/validation/declared-vs-actual.json",
          "diagnostics/ACTION_PLAN.md",
          "packages/shared-fingerprint/src/normalize.ts",
          "review/ja4m-security-review/validation/cross-service-http/declared-vs-actual.json",
          "review/ja4m-security-review/validation/cross-service-tls/declared-vs-actual.json",
          "review/ja4m-security-review/validation/final-exhaustive-tls/declared-vs-actual.json",
          "review/ja4m-security-review/validation/ide-profiles/declared-vs-actual.json",
          "review/ja4m-security-review/validation/long-running-http/declared-vs-actual.json",
          "review/ja4m-security-review/validation/long-running-tls/declared-vs-actual.json",
          "review/ja4m-security-review/validation/openclaw-runtime-http/declared-vs-actual.json",
          "review/ja4m-security-review/validation/openclaw-runtime-tls/declared-vs-actual.json",
          "review/ja4m-security-review/validation/service-mesh/declared-vs-actual.json",
          "scripts/derive-fingerprints.py",
          "scripts/run-openclaw-xai-smoke.sh",
          "services/openclaw-runtime/bin/entrypoint.sh"
        ]
      }
    ]
  },
  "generated_at": "2026-05-16T16:44:09.521Z"
}