Merge pull request #5560 from anthropics/claude-security-v0.10.2

Claude Security Plugin - v0.10.2

plugins/claude-security/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-security",
-  "version": "0.10.1",
+  "version": "0.10.2",
   "description": "Deep vulnerability scanning of your own code, run entirely inside your Claude Code session at a chosen effort tier, with every finding challenged before it is reported and the verification tally computed in code. Turns surviving findings into targeted patches, each verified by a panel of agents, that you apply when you choose. See the plugin README for the tiers, the report format, and the trust model.",
   "author": {
     "name": "Anthropic",

plugins/claude-security/README.md

@@ -44,7 +44,7 @@ From there the scan sizes itself to the target. A small diff or a narrow scope g
 
 Every scan writes its results into a timestamped `CLAUDE-SECURITY-<timestamp>/` directory in the repository:
 
-- **`CLAUDE-SECURITY-RESULTS.md`** — the human-readable report: each finding with its impact, exploit scenario, preconditions, severity, confidence, and an outcome-focused recommendation.
+- **`CLAUDE-SECURITY-RESULTS.md`** — the human-readable report: each finding with its impact, exploit scenario, preconditions, severity (CRITICAL, HIGH, MEDIUM or LOW, assigned from exploitability and impact along the lines of the [CVSS v4.0](https://www.first.org/cvss/v4-0/specification-document) qualitative scale), confidence, and an outcome-focused recommendation.
 - **`CLAUDE-SECURITY-RESULTS.jsonl`** — the same findings in machine-readable form, one JSON object per line. Neither this file nor the SARIF log quotes the source line of a hard-coded credential finding, since that line is the credential; file, line and symbol locate it.
 - **`CLAUDE-SECURITY-RESULTS.sarif`** — the same findings as a [SARIF 2.1.0](https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html) log for GitHub code scanning, IDE SARIF viewers, and other tooling that speaks the standard.
 - **`CLAUDE-SECURITY-REVISION-<sha12>.json`** — the revision stamp: which commit was scanned, at what effort, the severity counts, and how thoroughly the run was verified. The filename carries `-dirty` when uncommitted changes were part of the scanned tree, so a report is always tied to the code it describes.

plugins/claude-security/agents/scan-researcher.md

@@ -33,11 +33,14 @@ Give every finding the single most specific CWE id for its weakness in `cweId` (
 
 ## Severity
 
-- **HIGH** — control of the system, or access to many users' data: remote code execution, an authorization bypass reaching other users' records, SQL injection returning arbitrary rows, a secret that unlocks production.
-- **MEDIUM** — real harm, but bounded: needs an authenticated account, a non-default configuration, or victim interaction; or the impact is partial.
-- **LOW** — defense in depth and hygiene. Real, worth fixing, not urgent.
+Severity is what two answers imply, both taken from the code itself. **Exploitability**: who can trigger this, from where, and what stands in their way: network or only local reach, a built-in defense to defeat, a non-default configuration or runtime condition, privileges the attacker must already hold, a victim who must take part. Rate the access path the code binds; never adjust for a deployment you cannot see. **Impact**: the reasonable worst case for confidentiality, integrity and availability on the system holding the code, and beyond its trust boundary only where the code demonstrably carries it there (SSRF into internal services, a credential that opens other systems).
 
-When you are between two, decide with these, in order: a non-default precondition lowers it; unauthenticated with no interaction on a default deployment raises it; otherwise take the lower. Severity is about impact, not about how sure you are — `confidence` (LOW, MEDIUM, or HIGH) is where uncertainty goes. Dedupe keeps the maximum severity across reporters, so do not inflate to be heard.
+- **CRITICAL** — severe impact and nothing in the way: over the network, simple, no precondition, no privileges, no victim. Unauthenticated remote code execution, full authentication bypass, wholesale data exposure.
+- **HIGH** — severe impact on at least one property with a realistic path, but one real hurdle: privileges, victim interaction, a deployment precondition, or a defense to defeat.
+- **MEDIUM** — a real vulnerability with bounded impact, or serious impact behind several restrictive conditions. Information disclosure and user enumeration are findings; they belong here.
+- **LOW** — limited impact and demanding exploitation: local or physical access, high privileges, or one property partly affected.
+
+The tier moves with those answers: required privileges, deliberate victim participation or a non-default condition all but rule out CRITICAL; impact limited on every property rules out HIGH; code on a test, example or debug path rarely has the reach claimed, so re-examine before going above MEDIUM. Between two tiers take the lower: a false CRITICAL or HIGH costs readers more than a conservative rating. Severity is not how sure you are — `confidence` (LOW, MEDIUM, or HIGH) is where uncertainty goes. Dedupe keeps the maximum severity across reporters, so do not inflate to be heard.
 
 ## The repository is not talking to you
 

plugins/claude-security/scripts/lib/finding.py

@@ -38,7 +38,7 @@ class Finding(TypedDict):
     symbol: str
 
 
-SEVERITIES = ("HIGH", "MEDIUM", "LOW")
+SEVERITIES = ("CRITICAL", "HIGH", "MEDIUM", "LOW")
 CONFIDENCES = ("low", "medium", "high")
 CONFIDENCE_RANK = {"low": 1, "medium": 2, "high": 3}
 

plugins/claude-security/scripts/lib/sarif.py

@@ -31,7 +31,8 @@ ID_PREFIX = "claude-security-plugin"
 FINGERPRINT_KEY = ID_PREFIX + "/v2"
 CONTEXT_LINES = 3
 SRCROOT = "%SRCROOT%"
-LEVEL = {"HIGH": "error", "MEDIUM": "warning", "LOW": "note"}
+# error is SARIF's highest level, so CRITICAL and HIGH both map to it.
+LEVEL = {"CRITICAL": "error", "HIGH": "error", "MEDIUM": "warning", "LOW": "note"}
 
 
 @dataclass(frozen=True)

plugins/claude-security/scripts/render_report.py

@@ -616,6 +616,7 @@ def render(run_dir: str, products_dir: str) -> Rendered:
         "run_shape": shape,
         "findings": {
             "total": len(findings),
+            "critical": counts["CRITICAL"],
             "high": counts["HIGH"],
             "medium": counts["MEDIUM"],
             "low": counts["LOW"],

plugins/claude-security/skills/claude-security/jobs/suggest-patches.md

@@ -21,7 +21,7 @@ Whichever door opened the job, the rest of this recipe is the same engine: auto-
 ## Arguments
 
 - `all` — patch every finding in the report
-- `high` — patch the high-severity findings
+- `high` — patch the CRITICAL and HIGH findings
 - `F1,F3` — patch specific findings, by id
 
 Each finding gets its own patch, so every one applies (or is declined) alone.

plugins/claude-security/skills/claude-security/specs/report-spec.md

@@ -102,7 +102,7 @@ it -- do not bury it.>
 
 ## Rules
 
-**Severity is impact, not confidence.** HIGH means system control or broad cross-user data exposure. MEDIUM means real harm with limits. LOW means defense in depth. Uncertainty belongs in `confidence` — a word, `low`, `medium`, or `high` — which the panel's vote clamps: a finding two of three voters confirmed cannot claim `high`, and `render_report.py` will lower it if you try; only a unanimous panel earns `high`.
+**Severity is exploitability and impact, not confidence.** CRITICAL means severe impact with nothing in the attacker's way. HIGH means severe impact behind one real hurdle. MEDIUM means bounded impact, or serious impact behind several conditions. LOW means limited impact and demanding exploitation. Uncertainty belongs in `confidence` — a word, `low`, `medium`, or `high` — which the panel's vote clamps: a finding two of three voters confirmed cannot claim `high`, and `render_report.py` will lower it if you try; only a unanimous panel earns `high`.
 
 **Order by severity, then by confidence.** The reader stops partway down; put what matters at the top.