From f84b82cb40e8768a8721dabb686fe7bb47d6d56b Mon Sep 17 00:00:00 2001 From: Niroj33 <86530493+professor3333@users.noreply.github.com> Date: Mon, 9 Nov 2026 11:35:40 +0545 Subject: [PATCH] Import batch-07 and batch-04 as model-drafted labels Both batches were drawn for hand labelling and were submitted from model drafts on 2026-11-09 by the owner's decision: batch-07 (100 dev records) and batch-04 (138 test records), all model_draft_accepted, no annotation time recorded, guidelines v0.2. Neither adds manual records, so the release gates still cannot be judged as declared (4 hand-labelled test records). The batch-04 texts were read only to draft their labels; nothing was tuned or scored on them and the test-access log has no entries. CI checks batch-04 for provenance only. --- README.md | 4 +- annotations/README.md | 9 ++ annotations/batches/batch-04.jsonl | 138 +++++++++++++++++++++++++ annotations/batches/batch-04_report.md | 49 +++++++++ annotations/batches/batch-07.jsonl | 100 ++++++++++++++++++ annotations/batches/batch-07_report.md | 69 +++++++++++++ docs/annotation_plan.md | 11 +- docs/dataset_card.md | 7 +- docs/evaluation.md | 4 +- docs/targets.md | 3 +- 10 files changed, 385 insertions(+), 9 deletions(-) create mode 100644 annotations/batches/batch-04.jsonl create mode 100644 annotations/batches/batch-04_report.md create mode 100644 annotations/batches/batch-07.jsonl create mode 100644 annotations/batches/batch-07_report.md diff --git a/README.md b/README.md index d36658a..dfafa71 100644 --- a/README.md +++ b/README.md @@ -156,7 +156,7 @@ item can be highlighted in the original advisory. | 1 · Feasibility | Pinned ingestion, corpus statistics, label schema, offset-preserving preprocessing, pilot sample, annotation tooling | ✅ built | | 1 · Pilot | 100-document pilot (`pilot-2`: 22 hand-labelled, 78 from model drafts), [decision gate](docs/pilot_gate.md), guidelines v0.2 frozen, [acceptance targets](docs/targets.md) declared | ✅ done | | 2 · Baselines | Rules baseline, CRF + logistic-regression attributes and groups, evaluator with bootstrap CIs, evidence viewer | ✅ built · preliminary pilot dev scores | -| 3 · Neural models | Frozen leakage-safe splits, annotation batches (01–03, 06: model-drafted), DistilBERT and DeBERTa-v3 with span / role / group heads, experiment runner, CRF ablations and learning curve | 🟨 trained on model drafts (run 3) · DeBERTa ≈ CRF on held-out agreement, no clear winner | +| 3 · Neural models | Frozen leakage-safe splits, annotation batches (01–04, 06, 07: model-drafted), DistilBERT and DeBERTa-v3 with span / role / group heads, experiment runner, CRF ablations and learning curve | 🟨 trained on model drafts (run 3) · DeBERTa ≈ CRF on held-out agreement, no clear winner | | 4 · Reliability | Calibration and review policy, formatting robustness (rules: 100%), challenge-set and error-catalogue tooling | 🟨 tooling ready · thresholds await labels | | 5 · Application | FastAPI API, review UI, SQLite (WAL) with append-only history, exports, Docker Compose stack, release manifests, tested rollback, CI image smoke test | ✅ built | | 6 · Production | Benchmark harness, ONNX/INT8 export (FP32 parity exact), local proxy benchmarks and load tests, monitoring; CRF v0.1.0 measured and deployed (`app verify` passed) on the 2 vCPU / 4 GB target host | 🟨 CRF meets every serving target on the target host · transformers not yet measured there | @@ -174,7 +174,7 @@ split has not been touched. | CRF (`crf-pilot-2`, pilot train split) | 0.231 [0.062, 0.417] | 0.231 [0.062, 0.417] | 0.444 [0.000, 0.667] | | CRF (`crf-pilot-2-batch-01`, + 100 model-drafted `batch-01` records) | 0.444 [0.133, 0.667] | 0.444 [0.133, 0.667] | 0.300 [0.000, 0.750] | -**Label source.** Every annotation batch after the pilot (472 advisories annotated, 22 by hand) +**Label source.** Every annotation batch after the pilot (710 advisories annotated, 22 by hand) was submitted from model drafts, by the owner's decision. Accuracy is therefore measured only on the 10 hand-labelled dev documents above. Later results are reported as *agreement with the drafting model*, never as accuracy, and the release gates in [`docs/targets.md`](docs/targets.md) diff --git a/annotations/README.md b/annotations/README.md index bf03a24..95f76a0 100644 --- a/annotations/README.md +++ b/annotations/README.md @@ -27,6 +27,8 @@ advisory-database commit it was taken from, and the SHA-256 of the annotated tex | `batches/batch-02.jsonl` | Batch-02 annotations (train pool, enriched), 100 records, guidelines v0.2. | | `batches/batch-03.jsonl` | Batch-03 annotations (dev pool, natural), 112 records, guidelines v0.2. | | `batches/batch-06.jsonl` | Batch-06 annotations (dev pool, natural), 60 records, guidelines v0.2. | +| `batches/batch-07.jsonl` | Batch-07 annotations (dev pool, natural), 100 records, guidelines v0.2. | +| `batches/batch-04.jsonl` | Batch-04 annotations (test pool, natural), 138 records, guidelines v0.2. | | `batches/batch-*_report.md` | Batch import reports. | ## Origin @@ -71,5 +73,12 @@ hand-labelled dev documents. `evaluate --gold-origin manual` excludes it, and `c recorded. On 2026-11-05 the owner decided to continue with model-drafted labels, so results against these batches are reported as agreement with the drafting model, not accuracy. +`batch-07` (dev pool, 100 records) and `batch-04` (test pool, 138 records), guidelines v0.2, +were also drawn for hand labelling and were submitted from model drafts on 2026-11-09, by the +owner's decision: every record is `model_draft_accepted` (`model-batch-07-guidelines-0.2`, +`model-batch-04-guidelines-0.2`), with no annotation time recorded. The drafting process read +the batch-04 test texts; no model was developed, tuned or scored on them. CI checks batch-04 +records for provenance only. + Records follow the schema in `src/triggermap/schema/models.py` and the rules in `docs/annotation_guidelines.md`. diff --git a/annotations/batches/batch-04.jsonl b/annotations/batches/batch-04.jsonl new file mode 100644 index 0000000..029e161 --- /dev/null +++ b/annotations/batches/batch-04.jsonl @@ -0,0 +1,138 @@ +{"advisory_id":"GHSA-238w-f66p-w349","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"19d6d038d417461b90c6cf0aed8e90303d3f3350a01c676b920941327e48bbb6","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[209,247],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Tool-generated wording; named component."} +{"advisory_id":"GHSA-2799-6g5r-mmc7","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"484e9de8a2829297792e9472c7f89ae447f529b6a9211c0d6d71347651348fe4","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[178,201],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[576,619],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Restricted globals are mechanism."} +{"advisory_id":"GHSA-2gmv-2r3v-jxj2","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"63c368e6b7c9af4b85c9c2d71a90c722dc13f67ef482488a1ad03641d684f030","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[672,730],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c2","span":[1117,1164],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Victim action stays ACCESS (R3). R6: file:// context limits impact."} +{"advisory_id":"GHSA-2vhw-q7vh-7xv2","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"27c1658857cecd2fa5f8bf8c0cebcf2f530cd4eff3de1c79236fbde9ade52591","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[107,122],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'unauthenticated callers' is fused."} +{"advisory_id":"GHSA-2vrg-7rqv-prf9","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"f3a523d108d162fceb5dd3015555ce1b17463a598bef146821fc9a93ef3544f8","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[260,274],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[371,385],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Tool-generated wording."} +{"advisory_id":"GHSA-32g6-mg92-ghm2","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"ba48f00c355639dc2c4730ec16d519a11a3573b1be2dab41d041216b124b276f","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[95,123],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Hash collisions are mechanism."} +{"advisory_id":"GHSA-33qf-q99x-wpm8","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"67dbac9cdf7919549c43bce83d1ff20c43aa420ba01fd0e576e73afa7e619832","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[51,81],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[852,935],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c3","span":[1008,1071],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c4","span":[1173,1191],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[{"operator":"ALL","members":["c2","c3"]}],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Two-step sentence with 'then'. R6: local-machine scope limits impact."} +{"advisory_id":"GHSA-3492-cvg7-9mr2","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"2a4c3941a0ad4ffddd1754bd22df98e5bfd0e2438e2bd4916e00cc8f58750fc8","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[107,130],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[283,308],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c3","span":[479,490],"category":"CONFIGURATION","role":"NOT_REQUIRED","source":"gold"},{"id":"c4","span":[535,550],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R5: STRICT_MODE did not protect."} +{"advisory_id":"GHSA-365w-hqf6-vxfg","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"0a8d0ae49d99b17fff345296a0b3dd86b0c613375ef84580930c1f8040e7f0c9","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[148,174],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[362,382],"category":"USAGE","role":"UNCERTAIN","source":"gold"},{"id":"c3","span":[796,835],"category":"USAGE","role":"UNCERTAIN","source":"gold"},{"id":"c4","span":[1991,2011],"category":"USAGE","role":"UNCERTAIN","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R7: each endpoint belongs to one of seven separate vulnerabilities. Workarounds excluded."} +{"advisory_id":"GHSA-37g4-qqqv-7m99","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"1eed082385f986351916e5c45f71382ed6cf1fcf5d9209b3faa1964becdeac81","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[313,339],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[362,397],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c3","span":[2120,2165],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R4: 'appears' and 'may' hedge exploitation. Attack-scenario steps beyond these are mechanism."} +{"advisory_id":"GHSA-3r75-xc34-5f44","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"62a7cd05704f16cfafd898a914c7f9e280793b0a38023f50a1b34ce6e6527ad7","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[4177,4322],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[4328,4406],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c3","span":[4509,4575],"category":"PLATFORM","role":"REQUIRED","source":"gold"},{"id":"c4","span":[4627,4677],"category":"PLATFORM","role":"REQUIRED","source":"gold"},{"id":"c5","span":[4904,4973],"category":"CONFIGURATION","role":"UNCERTAIN","source":"gold"}],"groups":[{"operator":"ALL","members":["c1","c2","c3","c4"]}],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'Exploitation preconditions' list block. R7: CurlImpersonate applies to the non-HTTP escalation only."} +{"advisory_id":"GHSA-3xq5-x4fj-rff7","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"b386aaca13de820a449d556973f7522164eecd130fd520df18d855ad32f0fbea","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[107,145],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'unauthorized attackers' names no separable condition."} +{"advisory_id":"GHSA-434r-7c99-hwf3","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"ba4de60691afdbbf239b3d1f902173adcfddfdac1012fe60404c71c468e91fc3","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[68,82],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[175,189],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Redirect payload is R1."} +{"advisory_id":"GHSA-44vg-5wv2-h2hg","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"b6cf62944fc2d6acd7df5a58ee901fd86d770786aa48e73e3ed62d133d948142","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[126,238],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[306,355],"category":"USAGE","role":"UNCERTAIN","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R7: 'Additionally' introduces a second variant. Module examples are evidence."} +{"advisory_id":"GHSA-47h8-jmp3-9f28","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"f6a3cb50dea0c95cefb41db29e977ef874dfd3a762640b21a3dfedf37ba588c6","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[21,70],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Pre-1.2.0 note is version matching."} +{"advisory_id":"GHSA-48g7-3x6r-xfhp","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"bd6994f5edabef89c0377edbbcc506505c70585a6cdf8b0a700a68d8ac7e495d","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[87,112],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[157,171],"category":"CONFIGURATION","role":"NOT_REQUIRED","source":"gold"},{"id":"c3","span":[183,229],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R5: safe mode does not prevent exploitation."} +{"advisory_id":"GHSA-4f84-67cv-qrv3","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"e2972e0262a454e1be86589e478f15b8f5a46563ace71d1f6b4d841a55148df3","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"NO_EXPLICIT_CONDITION","conditions":[],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Malicious release: installing it is the exposure, nothing else stated."} +{"advisory_id":"GHSA-4h97-wpxp-3757","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"41ecead77b603a431511a7e86542508860a21526aa64fce06631ea1569298c53","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[174,213],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Operator concatenation is mechanism."} +{"advisory_id":"GHSA-4m32-cjv7-f425","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"5a14ef2b08d647f2e225cce160a7fb38561d99f03393ae30528fb7199421e8e7","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[467,504],"category":"PLATFORM","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'All ... are vulnerable'. Hard-coded key is mechanism."} +{"advisory_id":"GHSA-4rh7-jwg9-m28m","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"ede7b0bc283582c9b841db050d2f81bc709a80e453e1688159d52155f442653c","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[154,191],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Leak locations are impact."} +{"advisory_id":"GHSA-52cq-7v8r-62c6","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"b86c0ba729b2ad93f5d1162621aa6d4d765b51164a69b6609100ec1a91bc204c","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[574,596],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c2","span":[703,732],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c3","span":[1712,1768],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c4","span":[1770,1815],"category":"PLATFORM","role":"REQUIRED","source":"gold"},{"id":"c5","span":[1937,1948],"category":"ACCESS","role":"NOT_REQUIRED","source":"gold"}],"groups":[{"operator":"ALL","members":["c3","c4"]}],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Attack model sentence links both. Second and third issues are separate findings without explicit conditions. 'unauthenticated' is fused."} +{"advisory_id":"GHSA-556j-vv39-8rqv","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"ae40b8ddcf1c6304a9315cffd322084764f88caf1b77874ae1ecae95a3ce150e","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[104,144],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[233,285],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c3","span":[1298,1380],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Examples in parentheses excluded. PoC excluded."} +{"advisory_id":"GHSA-58hv-7753-xmfq","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"ec7856ba8a4ea1b12c5b2eb1a574f7be4705ca182c1776ed5f0e464a070f03ed","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[133,162],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c2","span":[559,579],"category":"PLATFORM","role":"UNCERTAIN","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R4: 'particularly impactful' hedges the platform."} +{"advisory_id":"GHSA-58pv-8j8x-9vj2","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"1774b66c64cab76b47b28f0aee413a2fc631b1c2f01859828302d09d1974419e","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[171,204],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[308,344],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c3","span":[10273,10355],"category":"USAGE","role":"UNCERTAIN","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R4: 'especially if' hedges the remote-download case. PoC excluded."} +{"advisory_id":"GHSA-5923-r76v-mprm","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"cc8af591816e5a32080d69d77aef3b14a2a2bd9654107fc5c8887078016f2720","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[2471,2497],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Unvalidated next parameter is mechanism. PoC excluded."} +{"advisory_id":"GHSA-5grr-72f9-678v","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"f895d84e6cc2b79cffab773ee247bba1b4d3fa6b4048dc89da62be7abf4c3144","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"NO_EXPLICIT_CONDITION","conditions":[],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Malicious package: installing it is the exposure, nothing else stated."} +{"advisory_id":"GHSA-5h3g-px23-w6vw","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"318b45210d5fbcbeaec93007a3a86d661cf164083196e645848f60affe6899fe","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[340,362],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[575,595],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c3","span":[861,902],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c4","span":[1168,1233],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c5","span":[1540,1609],"category":"ACCESS","role":"UNCERTAIN","source":"gold"},{"id":"c6","span":[1619,1746],"category":"PLATFORM","role":"UNCERTAIN","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R7: last two apply to the file-read variant only."} +{"advisory_id":"GHSA-5hr4-253g-cpx2","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"5506b9740f7ab3b92fe12583465fc4d25a54ad65b842222b19d1d11b617eb063","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[630,650],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c2","span":[738,768],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c3","span":[873,1020],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c4","span":[2129,2149],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c5","span":[10515,10586],"category":"ACCESS","role":"NOT_REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Default status is evidence, excluded. Remediation and PoC excluded."} +{"advisory_id":"GHSA-5hwf-rc88-82xm","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"7670836e95e91ce274b16d8080845d60a0eeb5a2d883e9649760d455137b3097","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[4161,4209],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Module list and opcodes are payload (R1)."} +{"advisory_id":"GHSA-5p39-cfhj-2xmp","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"30fc41af09e0ad1951d05d1a01d7bdbe1ef923b31a820b2c9c442313d518839e","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[91,111],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[355,420],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c3","span":[547,607],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Closing sys.stderr is a workaround."} +{"advisory_id":"GHSA-5r2p-pjr8-7fh7","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"2fc928d2a7c36f4e82f2f2a60a6cec063c1e5ad86af681a7cd9200795339b5c8","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[57,87],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[243,314],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c3","span":[1051,1142],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Best-practice list excluded."} +{"advisory_id":"GHSA-5v57-8rxj-3p2r","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"383adab22900d85e094431f33c071fa5b5a208b39b8bc14f21e1b068e6e5fa6c","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[233,318],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Chained precondition stated with 'When combined'."} +{"advisory_id":"GHSA-5vgj-ggm4-fg62","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"8f162d091adac283473d937a4323e8a760af56b6869dbd91fb3505cd2a67ea96","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[37,57],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c2","span":[96,107],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c3","span":[229,265],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c4","span":[293,308],"category":"CONFIGURATION","role":"EXCEPTION","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'All other users are unaffected' is explicit."} +{"advisory_id":"GHSA-5vp3-3cg6-2rq3","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"fd2cd53f208cb5401e8c637b5a4b7a4f6ef21e6a3e4a7b20f90b41ff26905d5a","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[109,154],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[553,617],"category":"PLATFORM","role":"REQUIRED","source":"gold"},{"id":"c3","span":[2147,2252],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Backtick payload is R1."} +{"advisory_id":"GHSA-5x67-j5xg-c5gj","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"095a6cdbcb7a751d637a0e48b397779b3d1ea7745ddab94aacba6dd925bb5d93","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[719,736],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R6: ingestion-only scope limits impact."} +{"advisory_id":"GHSA-635v-pc42-fr74","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"3a8322fd1d99f44dea07e1e951a5b0bbcfea022a21c849d11553050da4a78150","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[289,324],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c2","span":[339,391],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c3","span":[400,457],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c4","span":[509,529],"category":"PLATFORM","role":"UNCERTAIN","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R7: unexpired token applies to the package-publish escalation."} +{"advisory_id":"GHSA-6523-jf4r-c962","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"7092ec7a0b9ecda0b62a6fb6f0376416a3007c5f1c2000fd4a2c7a29b6c84b3a","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[306,340],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'only possible for' is explicit."} +{"advisory_id":"GHSA-6gvq-jcmp-8959","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"19c043a415b95814202b626c0d02920822400b8089bd672e825fe846ec561d55","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[487,541],"category":"PLATFORM","role":"UNCERTAIN","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R4: 'depending on' hedges the condition."} +{"advisory_id":"GHSA-6qhv-4h7r-2g9m","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"9fa4a972fa71702f2b65e39a941e937b32fca0d701fdda5dc53bff22aab0ed2f","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"NO_EXPLICIT_CONDITION","conditions":[],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Signature verification flaw with no deployment condition stated."} +{"advisory_id":"GHSA-6w46-j5rx-g56g","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"4e1050bceb1ee27b5262b4cede802c1e6a31b6dfcb5fe230480df55e770d0e99","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[63,67],"category":"PLATFORM","role":"REQUIRED","source":"gold"},{"id":"c2","span":[148,159],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R4: 'possibly gain privileges' hedges impact."} +{"advisory_id":"GHSA-747p-wmpv-9c78","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"95f91c08505856787bbb7396a55958d636addbe6a43dafc94d6143649a5126f5","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[68,80],"category":"PLATFORM","role":"REQUIRED","source":"gold"},{"id":"c2","span":[165,195],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c3","span":[281,321],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c4","span":[353,375],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c5","span":[498,521],"category":"PLATFORM","role":"REQUIRED","source":"gold"},{"id":"c6","span":[667,712],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. '(disabled by default)' is evidence. Workarounds excluded."} +{"advisory_id":"GHSA-75jv-vfxf-3865","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"dc809b837df17bc2cad2e1bd5b99c07a41f237fc2dd9f7de4d92bd559d263d03","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[226,342],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[1123,1193],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R6: containerisation limits impact; not stated as a carve-out."} +{"advisory_id":"GHSA-75mj-4g74-9rg2","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"56f3e25a9f3a7ced3f6ff2a17f05f768b55f674b20c45997bc616efee55106da","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[171,263],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[388,406],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Stated with 'when'."} +{"advisory_id":"GHSA-76qh-xr7q-h39m","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"c5b921cc1708193bce08b5a947b025c1bdb173a65e687efdff89df05f16053c7","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[181,196],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[284,309],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c3","span":[529,577],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c4","span":[699,751],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'All ... are affected' is explicit."} +{"advisory_id":"GHSA-76rv-2r9v-c5m6","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"bd222becd08e4302dfd76c21a2dadb9bd3e374a73d23ce7420643dc261ceaa65","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[202,221],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[636,690],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c3","span":[1295,1320],"category":"PLATFORM","role":"UNCERTAIN","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R7: cross-tenant impact is escalation. Remediation design excluded."} +{"advisory_id":"GHSA-79rp-v9rm-gxm8","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"b9284d758aa1c8c61ea7a1a09c4c246316a1b0ca5504bd6c9d06bf4dfce863cb","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[96,115],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Large filename is payload (R1)."} +{"advisory_id":"GHSA-7h6r-6p76-68c9","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"fb98c1ffaf671b4dfbec5cf1009226250218ebb806962852fb90cd46406e32ae","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[837,986],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'requires the victim to' is explicit."} +{"advisory_id":"GHSA-7h8w-hj9j-8rjw","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"ea47d14c7b591f7267b4ddc13d5b966cd32cf6bcc021928f5e3b0e50b548ac36","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[229,287],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[339,362],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c3","span":[2184,2250],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c4","span":[2255,2273],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c5","span":[2593,2616],"category":"PLATFORM","role":"UNCERTAIN","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R7: container escape is escalation."} +{"advisory_id":"GHSA-7p73-8jqx-23r8","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"77df28888761abe3156eb053d77c3d55a87d27596ad09d82d5f803ab2f14eff8","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[806,846],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[890,953],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c3","span":[959,1109],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c4","span":[1115,1195],"category":"USAGE","role":"EXCEPTION","source":"gold"},{"id":"c5","span":[1229,1300],"category":"PLATFORM","role":"EXCEPTION","source":"gold"}],"groups":[{"operator":"ALL","members":["c2","c3"]}],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'vulnerable only if it ... and' list block."} +{"advisory_id":"GHSA-82r6-8w77-94w6","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"d703596a320c892b757a236165804f3a9df41be84bbf1304ace7d43e43908d51","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[97,154],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[211,265],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c3","span":[276,363],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R4: 'potentially vulnerable' hedges exploitation."} +{"advisory_id":"GHSA-8jf4-fcjr-68c2","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"f2452bb5d5997290af847e481d4780749259088ffef78279cabb2d392422d369","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"NO_EXPLICIT_CONDITION","conditions":[],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Tool-generated: names a stdlib call and file, nothing a developer checks."} +{"advisory_id":"GHSA-8mf9-rmgw-33qc","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"cf299b0a827020243e350d63fccceeb18eccef8a77df434f348eebce97d84dc3","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[178,205],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Concatenation is mechanism."} +{"advisory_id":"GHSA-8vh3-g2qg-2h2c","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"ea0c355f33410ac3eded2385ce1130fc5a2696aad4918e218742c8118bb2c1d0","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[106,129],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c2","span":[155,188],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c3","span":[1400,1411],"category":"ACCESS","role":"NOT_REQUIRED","source":"gold"},{"id":"c4","span":[1435,1488],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c5","span":[1960,1979],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Default status is evidence. Fix code excluded."} +{"advisory_id":"GHSA-8xwf-cr4r-856r","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"ec3afe7e0c634ccf4c8d45b063845e2a234ee64c12330168479bcd3f977ebea2","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[165,203],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c2","span":[405,441],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'All deployments ... are affected' is explicit."} +{"advisory_id":"GHSA-937x-gpqr-72gg","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"ab53d574ab40a9007e54fe178fc5fb66ff186d979a30b8227b64c9a070556f7b","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[2394,2419],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c2","span":[2500,2613],"category":"PLATFORM","role":"REQUIRED","source":"gold"},{"id":"c3","span":[4721,4746],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c4","span":[4822,4873],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c5","span":[4875,4979],"category":"PLATFORM","role":"REQUIRED","source":"gold"},{"id":"c6","span":[5522,5537],"category":"CONFIGURATION","role":"EXCEPTION","source":"gold"}],"groups":[{"operator":"ALL","members":["c3","c4","c5"]}],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'three preconditions' list block. 'Pure allowlists are unaffected' is explicit."} +{"advisory_id":"GHSA-94jw-hqvj-vw74","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"ec259bcfe861fdb4cc92dbacfef2e5ff8f638b01f6b8eb47e86697591ddf70db","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[281,303],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c2","span":[307,368],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Allowlist is the bypassed feature in use, so REQUIRED."} +{"advisory_id":"GHSA-954p-556p-r752","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"b77d245d5c0ca22a946f29394cebc29dfeb195bb5cca94f49342a0b14ea04a3f","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[446,480],"category":"CONFIGURATION","role":"EXCEPTION","source":"gold"},{"id":"c2","span":[2187,2223],"category":"PLATFORM","role":"REQUIRED","source":"gold"},{"id":"c3","span":[2428,2514],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c4","span":[2525,2547],"category":"PLATFORM","role":"REQUIRED","source":"gold"}],"groups":[{"operator":"ALL","members":["c3","c4"]}],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'Only affects users who' is explicit; 'with' joins them in the impact sentence. Scenarios are examples."} +{"advisory_id":"GHSA-9663-mqmp-p9mm","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"229399936c0f69e24a40926d48b67a1df5be5ed11b16fa57f14cef4972805520","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[573,630],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c2","span":[958,988],"category":"PLATFORM","role":"UNCERTAIN","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'unauthenticated' fused, left out of the span. R7: memory limits apply to the OOM escalation."} +{"advisory_id":"GHSA-997v-r4v7-9f3g","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"4a96cc84cd615ba43c186a1e189402c6ef1b04d76f22d1c18a61772d684b3b38","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[35,54],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[164,191],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Tool-generated wording."} +{"advisory_id":"GHSA-9ggr-2464-2j32","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"1c6dc31555b18a41261a2f0f1bbb566086d2cc68308c168a3653f1c93ea7001e","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[580,634],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[681,722],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c3","span":[3213,3295],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c4","span":[3299,3364],"category":"PLATFORM","role":"REQUIRED","source":"gold"}],"groups":[{"operator":"ANY","members":["c3","c4"]}],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Explicit 'or' in the impact statement. Token contents are payload."} +{"advisory_id":"GHSA-9gmc-jqmh-3rvm","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"62bd10bb1e921bb672c8bb5364088ca930899a66f9121bbb011a023c04015273","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[2369,2382],"category":"USAGE","role":"UNCERTAIN","source":"gold"},{"id":"c2","span":[5536,5563],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c3","span":[5737,5763],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R4: 'most acute on' hedges copier update."} +{"advisory_id":"GHSA-9gq7-p5w9-w899","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"3a1acd364bcad13f5401aaf41086d643a27c4b4bec4179bb950be2a93549353d","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[115,132],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[160,187],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c3","span":[244,268],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R1 input kind plus delivery."} +{"advisory_id":"GHSA-9m39-3mf3-xwch","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"f3d1a605974b307d2f03290a93069c0eb90d72869e531d541a764451bc66292a","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[91,119],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Stated trigger."} +{"advisory_id":"GHSA-9p73-x86v-jw57","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"54e78361eb3ab07ba2b361dd1230b7a4313450194001c1000a3dacc0d03370ef","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[274,303],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R6: subfolder names only limits impact."} +{"advisory_id":"GHSA-9w56-46f6-3qhx","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"90ba26cf30dfe810bdfd7a2da62512bae650a3ac624028fbf86e8e89694a48e7","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[586,639],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[4330,4419],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c3","span":[4438,4452],"category":"ACCESS","role":"NOT_REQUIRED","source":"gold"},{"id":"c4","span":[4495,4501],"category":"CONFIGURATION","role":"NOT_REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. '(the default)' is evidence. use_numpy=False is mitigation."} +{"advisory_id":"GHSA-9xq9-36w5-q796","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"fb25543155b9e11dce6a4c75ebc1e516aa93c76ac4bc8f8254d0ab6756753798","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[6333,6427],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[7725,7774],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c3","span":[8011,8061],"category":"PLATFORM","role":"UNCERTAIN","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R7: multi-tenant scope change is escalation. Hardcoded flag is mechanism."} +{"advisory_id":"GHSA-c795-2g9c-j48m","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"bd3e6917d8130690c1701f525349637b0bb591ec1a27ad7dbce747829caa1c49","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[153,195],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'unauthenticated caller' is fused; sender_id traversal is payload."} +{"advisory_id":"GHSA-c9vm-hv86-f23r","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"956af9c30d088cb7e1805bb204e45eaf4002dadba475c197b4a2056610ed8a1d","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[2560,2600],"category":"USAGE","role":"UNCERTAIN","source":"gold"},{"id":"c2","span":[2601,2636],"category":"USAGE","role":"UNCERTAIN","source":"gold"},{"id":"c3","span":[2637,2688],"category":"CONFIGURATION","role":"UNCERTAIN","source":"gold"},{"id":"c4","span":[2689,2753],"category":"CONFIGURATION","role":"UNCERTAIN","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R7: each item applies to a different group of fixes in a multi-issue release."} +{"advisory_id":"GHSA-cj54-hpcc-gj6h","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"83d1f81b7f7ce6664843c715038acae8f7ce43a22c1650fb93284f49128e5176","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[2042,2109],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c2","span":[2110,2133],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c3","span":[2156,2191],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"}],"groups":[{"operator":"ALL","members":["c1","c2","c3"]}],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'Prerequisites' list block. Default notes are evidence."} +{"advisory_id":"GHSA-cq37-g2qp-3c2p","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"5b72a2a5c09002ece4bc24ba88f5312d5dbf62faa5ba0d19051438b67798c23e","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[44,62],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Disabling the dashboard is a workaround."} +{"advisory_id":"GHSA-fgmx-xfp3-w28p","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"422b243c063c7635d12c5f64e8520708712c69a564ce9dfd18fe5784fc79b463","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[261,275],"category":"ACCESS","role":"NOT_REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'is not required' is explicit. Allowed-commands handling is mechanism."} +{"advisory_id":"GHSA-fr49-mhgj-crfc","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"20836ed1f3930d2c4152a792b511e78010a8f8f5a4f3f7e423b2342102a98471","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[122,149],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Fragment amplification is payload (R1)."} +{"advisory_id":"GHSA-g82g-j283-hj97","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"3faf704e4aec6be19606d8218ccc95cdbb208a761c81fb7d1cb2806bd2a938e4","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[203,228],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[442,483],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Examples in parentheses excluded."} +{"advisory_id":"GHSA-gg2g-p7xc-qqmm","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"54a27a024db52071eab4a07d66ce4c83c275cadd1626e5d8f6afa8f1f537e284","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[190,218],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[500,539],"category":"ACCESS","role":"NOT_REQUIRED","source":"gold"},{"id":"c3","span":[546,609],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c4","span":[3972,4090],"category":"USAGE","role":"UNCERTAIN","source":"gold"},{"id":"c5","span":[4246,4288],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R7: pipeline case is an escalation scenario."} +{"advisory_id":"GHSA-gm8q-m8mv-jj5m","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"980c4f77667672f3112eca5b569fb4062d32ff02293d4f60068c7a87ff718473","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[133,155],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[236,283],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c3","span":[458,482],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c4","span":[822,857],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Workarounds excluded."} +{"advisory_id":"GHSA-gq6f-qwv9-rf4j","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"78c9e12e6230eed71e0facf1a50b4e6bfa0a714232cb49c093fd452f5e7ad3cd","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[176,223],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'unauthenticated users' is a fused negation."} +{"advisory_id":"GHSA-h254-g997-685c","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"2bb5efd88987c88bf2bb68d063e512d7fbf1e4dec800290dfb24cf6f902de4fb","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[181,202],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Path parameter is the vector."} +{"advisory_id":"GHSA-h672-p7h7-97v9","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"0d9c5eaf1ec9ec3a4ea6af610a5b5f0374ed2b9cc8c0b3b907d1fd9951bb4bbb","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[367,397],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c2","span":[588,643],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c3","span":[645,692],"category":"USAGE","role":"UNCERTAIN","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R4: 'not expected to allow' hedges the carve-out."} +{"advisory_id":"GHSA-h952-963h-rv99","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"e5208ccb91fedd46aff275c54866cee83a84bda4241ff1496b6c2da371aad5b4","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[104,133],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Stated trigger."} +{"advisory_id":"GHSA-h9f9-h6gm-wc85","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"c3dd64e17ba7729ab404eee56970224cac910a15c718a9fe9f6dd00defde28b2","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[154,183],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[622,649],"category":"CONFIGURATION","role":"UNCERTAIN","source":"gold"},{"id":"c3","span":[881,909],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c4","span":[6218,6251],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R7: 0.0.0.0 bind is the remote variant. 'Unauthenticated' is fused. PoC excluded."} +{"advisory_id":"GHSA-hhfx-wfvq-7g9c","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"51dfe5bab84897c6dbf3a4e8de28df71e5f8f38f8a6e1b47729dc45a6d26ef17","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[67,86],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c2","span":[190,209],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Title and body repeat."} +{"advisory_id":"GHSA-hq4h-w933-jm6c","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"e5e07fa21f72af51d9ad711f36f1f8a0b1ec56b53143567e4c3c272ac5a1cc93","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[164,192],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[204,222],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Email parameter manipulation is the method."} +{"advisory_id":"GHSA-j35x-w4gj-pf7w","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"2eb93403f2b206340b0d4de98e22756dc9b1e2f528c87356337a47d2142530a7","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[598,744],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'requires the victim to' is explicit; one description."} +{"advisory_id":"GHSA-j5rm-v3vh-vx94","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"0c337ad9d262ea8c840209ea5d8d59151b5271dc66d5e9318c2250ba374e9fd3","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[120,156],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Disabling userless login is a workaround."} +{"advisory_id":"GHSA-j5xp-7m2f-49jv","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"88f0d26acf57c02022e4f78659ce2e2e2a8a288dae247a74deaf53447cd5c249","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[245,278],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Stated with 'In applications that'. Workarounds excluded."} +{"advisory_id":"GHSA-j842-xgm4-wf88","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"f2f7e4291f8d266da67a80db2e2be9dbbd4dd5bd2ff1c54121e43c3ea08f15b3","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[80,102],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[108,136],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c3","span":[4695,4744],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. ASAN output excluded."} +{"advisory_id":"GHSA-j8cv-x86q-rj85","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"3a46ac454c3568bb03698bd582d3600a964bf45ba4e34cd34de185515bb8681e","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[231,249],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[403,435],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c3","span":[805,855],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c4","span":[2998,3049],"category":"PLATFORM","role":"REQUIRED","source":"gold"},{"id":"c5","span":[3056,3108],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c6","span":[5840,5964],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c7","span":[6626,6770],"category":"PLATFORM","role":"REQUIRED","source":"gold"}],"groups":[{"operator":"ALL","members":["c4","c5"]}],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'while' joins exposure and credentials in one sentence. Localhost default is evidence. 'Unauthenticated' is fused. PoC excluded."} +{"advisory_id":"GHSA-jh67-hwqw-m5r7","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"76e0f44705d4f9f7a9e35e599008debf90230c56a50e1406a77aefb4afc45cff","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[94,149],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[155,216],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Code excerpt excluded."} +{"advisory_id":"GHSA-jv2h-4p9v-wf5w","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"ac3a070895063f6fd73abb9395c9e635f04e58b8a849bb216ff3ee7fc698b1cc","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[48,70],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[370,391],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c3","span":[1749,1784],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Key list is mechanism. Workaround excluded."} +{"advisory_id":"GHSA-m5vv-6r4h-3vj9","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"fb01bfa3dd94a5aac20733c61c45819500fde17673dc720af0ff5347e48784a1","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"NO_EXPLICIT_CONDITION","conditions":[],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Title-only advisory."} +{"advisory_id":"GHSA-mcgx-2gcr-p3hp","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"efc3385c45c2ec78440907d117106e20e80dd8fb4712c319615f34ba2e5f8538","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[99,185],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'Only users that' is explicit."} +{"advisory_id":"GHSA-mr4r-hcgx-8p4h","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"bbb85596012116b9ee3448ecebd2066024e3aeecc91e5250f4fdf24d3f292128","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[142,163],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Redirect and rebinding are attacker methods."} +{"advisory_id":"GHSA-mrmh-3hqh-pfw7","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"898de061658552bebbe8e83e0d950bfe2212deea5f8995a141e73f13565dfc3f","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[171,190],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Tool-generated wording; named component."} +{"advisory_id":"GHSA-p5wc-9w9r-m232","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"d7b32f85b7dc7ed30d6010bf753329ef96eeed5afd80e452bf7322d545382e7e","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[222,253],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[383,408],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c3","span":[556,614],"category":"ACCESS","role":"NOT_REQUIRED","source":"gold"},{"id":"c4","span":[685,755],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c5","span":[4337,4405],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c6","span":[4437,4523],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c7","span":[4593,4693],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c8","span":[4716,4767],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c9","span":[4781,4838],"category":"ACCESS","role":"NOT_REQUIRED","source":"gold"},{"id":"c10","span":[4925,4991],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Affected list states no operator, so not grouped. PoC excluded."} +{"advisory_id":"GHSA-p8h7-c8gw-6x8c","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"836c02d7d6d4edc5afacbcb507b3ee29727afd749c1a034a71c38234e442831c","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[389,403],"category":"PLATFORM","role":"REQUIRED","source":"gold"},{"id":"c2","span":[646,666],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Backslash payload is R1."} +{"advisory_id":"GHSA-pf5v-pqfv-x8jj","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"c264d3fc49a5ad213cc344d450ca038fdf84365f255025b4e071735a81950ecf","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[152,207],"category":"PLATFORM","role":"REQUIRED","source":"gold"},{"id":"c2","span":[216,242],"category":"PLATFORM","role":"REQUIRED","source":"gold"}],"groups":[{"operator":"ALL","members":["c1","c2"]}],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'but' joins both in one sentence."} +{"advisory_id":"GHSA-pfrv-63w8-q7rq","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"21a9eaf8e3acc05e198a6582ff4ada62c2d67e07e01a1fe47831857480585f30","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[267,287],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. file parameter is the vector."} +{"advisory_id":"GHSA-pg97-jvmf-qfvc","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"b46f40bc3629d5571866d3f7bb280edec3ea6a09ee2e614591edb292124c0db9","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[44,72],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[291,330],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Disabling SSE is a workaround."} +{"advisory_id":"GHSA-pjjw-68hj-v9mw","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"61963f9baa0d568667f54649b396e8844bf72e4611364ac729470d8a2cc9cdef","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[805,835],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c2","span":[849,890],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c3","span":[922,969],"category":"ACCESS","role":"UNCERTAIN","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R7: depth guess applies to targeting system files. R6: files-only limits impact."} +{"advisory_id":"GHSA-pmqc-57g8-c22c","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"f2cb6db867827d078eb741d63a4e71f78731a151c9e4c9eb8481fef6b19127f7","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[271,287],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Tool-generated wording."} +{"advisory_id":"GHSA-pp84-v3mw-gg4w","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"1f4328b9895e7111ffec977beb39484ea9cb01a49cc7a16f5f2407729b39e9ba","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"NO_EXPLICIT_CONDITION","conditions":[],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Dependency CVEs only; no deployment condition stated."} +{"advisory_id":"GHSA-pr85-w493-9w3x","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"e1a7ed7f7f926ca9bf055ac2704936f798e7d82d8426820412d32c5dd10e80fa","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[264,329],"category":"USAGE","role":"UNCERTAIN","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R4: stated as a severity assumption. Spelling kept."} +{"advisory_id":"GHSA-pwwp-3q7j-9mx8","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"909e35a07503de77f97057eece4a7742c4352662bbe1afb43700ee7ed7f55132","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[592,638],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Tool-generated wording."} +{"advisory_id":"GHSA-q65w-fg65-79f4","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"2f154912c830e6b8320d455c25e51c8465dc02c2320872bc03a859880a3b398d","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[236,263],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[429,503],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c3","span":[1473,1554],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R8: these functions/operations named in the same paragraph. Short-term advice excluded."} +{"advisory_id":"GHSA-q78p-g86f-jg6q","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"e95dfd735cd6a7acc117ca8c1f9f34fae0df74c09c312cbca4bd105b9a270997","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[366,387],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c2","span":[561,577],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R6: containers confine impact."} +{"advisory_id":"GHSA-q986-4x7x-gx39","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"4a2b2784d32bd816c7595a4db542f405f72c1ca766c52919defa43163d7b1491","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[175,209],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[4156,4208],"category":"CONFIGURATION","role":"UNCERTAIN","source":"gold"},{"id":"c3","span":[5731,5746],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c4","span":[6364,6450],"category":"PLATFORM","role":"REQUIRED","source":"gold"},{"id":"c5","span":[6605,6663],"category":"ACCESS","role":"NOT_REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R7: mail credentials needed only for metadata disclosure. Defaults are evidence."} +{"advisory_id":"GHSA-q9r5-6hrr-9ph7","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"7c10e03537cf6666743244e30a94025f2f57e2d6590a1f5f9dccdc5a953999a2","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[112,134],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[329,343],"category":"ACCESS","role":"NOT_REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'is not required' is explicit."} +{"advisory_id":"GHSA-qccg-9m4q-xfm6","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"4dc58f444e4b8ad724aef6caa18730543f5240024e32962a29c59384d1a539f8","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[117,152],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'without any access control' is mechanism."} +{"advisory_id":"GHSA-qfwv-87qj-98xq","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"27d5849d02a6e319c835f40d586aa6b986121b5c83ea94254245b737d7d644b4","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[70,97],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Circular fragments are payload (R1)."} +{"advisory_id":"GHSA-qr2g-p6q7-w82m","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"86a11348cba8cab6b2e8aef5dfc3d0e2af5da596e8b24df94ad8308d20d021e7","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[209,254],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[350,394],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c3","span":[460,467],"category":"USAGE","role":"EXCEPTION","source":"gold"},{"id":"c4","span":[555,602],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'not required to upgrade' read as not affected."} +{"advisory_id":"GHSA-qxq5-qhx6-94qw","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"3b12cb175ba311c13c22af6dda42f3663e8c53e68803c284539b963dc25ed78f","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[25,43],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[2291,2318],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Span stops at a line break (section 2). Pickle construction is payload (R1)."} +{"advisory_id":"GHSA-r54c-2xmf-2cf3","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"b8066850b92792812064454b715b0c476c45ae2b06157a5b8fb2de69d9ce822d","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[293,349],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[375,404],"category":"PLATFORM","role":"REQUIRED","source":"gold"},{"id":"c3","span":[2424,2453],"category":"PLATFORM","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Dependency version is an environment condition. Web-UI steps are PoC detail."} +{"advisory_id":"GHSA-r5vv-ff45-prp2","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"fe74aba3273954005f5e68d5caa564a2eb6e1251eb0020538f5e44be086965a6","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[166,218],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[1926,2028],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c3","span":[2038,2093],"category":"PLATFORM","role":"REQUIRED","source":"gold"}],"groups":[{"operator":"ALL","members":["c2","c3"]}],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'when' joins them in the Impact sentence; reviewer may prefer no group."} +{"advisory_id":"GHSA-rcr2-hggw-43wm","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"7bd5f0bf6fa51e927aa644bbcdb3eeeecfda265a92e3f6041977dd443140779c","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[211,277],"category":"USAGE","role":"UNCERTAIN","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R4: stated as a severity assumption. Spelling kept."} +{"advisory_id":"GHSA-rmjr-87wv-gf87","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"0ef63bfcfca103b9f9a6f8bccbc87e06260b60416fcfb49ab8defb6deedca0bc","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[376,440],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Parenthetical attribute names excluded. Special device files are payload."} +{"advisory_id":"GHSA-rxq8-q85f-m866","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"ac3bf78c6e69ce376ba0ecf3d2eac850b212350b948ec11a32c73474ad2a499c","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[627,686],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'attacker needs to be' is explicit. Endpoint list is mechanism."} +{"advisory_id":"GHSA-v49p-m6gh-747c","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"e20a046d86ce783f6e9db8884d0bd26882f23ac52bc52d485b64628ec90b8633","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[123,152],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[301,438],"category":"CONFIGURATION","role":"UNCERTAIN","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R4: bypass of custom checks matters only if configured; not stated as required."} +{"advisory_id":"GHSA-v5jw-96jm-7h2c","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"c9782cbe04f419ee80652f253d99c77fb9a3e1a0fb5498ec9ae538f672039653","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[501,549],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c2","span":[691,718],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c3","span":[2274,2287],"category":"PLATFORM","role":"UNCERTAIN","source":"gold"},{"id":"c4","span":[5152,5263],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c5","span":[5589,5656],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R7: old PyTorch applies to the lemma-classifier loader only. Delivery vectors are examples."} +{"advisory_id":"GHSA-vcqx-v2mg-7chx","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"b45cea9ca77bf78c9ccf74961f9826bf319f9004fcbc2390643cb9360cec79a6","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[235,270],"category":"PLATFORM","role":"REQUIRED","source":"gold"},{"id":"c2","span":[297,405],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. stdio mode is a workaround."} +{"advisory_id":"GHSA-vh3x-525m-jp4r","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"8a6a9d872149225e3e36cfc94d973ff3249341abb2071f7ca8cd0b1f8005505c","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[503,536],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Stated trigger; mpz_as_bytes is internal. Tool-generated wording."} +{"advisory_id":"GHSA-vphc-468g-8rfp","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"5ec5e4b6d3b81ab6eeb89f5ef5a8aa383f43a8271b563320c977d96cd5101846","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[260,318],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. table_name payload is R1."} +{"advisory_id":"GHSA-vq2f-vcc9-j8mv","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"05f7a8131f1fb41f9103ee88c7d6d2772e384566afad249bec9b840925a50752","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[265,291],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Malformed tag is payload (R1). Workaround excluded."} +{"advisory_id":"GHSA-vrxg-gm77-7q5g","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"0585bdfc758622081411c95bc8cc14899abf24a0256ef93480eb864f6b25aa5a","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[13,28],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c2","span":[194,233],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c3","span":[239,257],"category":"CONFIGURATION","role":"EXCEPTION","source":"gold"},{"id":"c4","span":[1596,1643],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'default stdio mode is not affected' is explicit. Browser private-network caveat narrows reach only."} +{"advisory_id":"GHSA-vv4j-m4vr-f3g6","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"f8cce448dea82d386ab015cdbae2e90952ad6ec57a361d335e3a074a567cac2e","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[139,160],"category":"PLATFORM","role":"REQUIRED","source":"gold"},{"id":"c2","span":[440,467],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c3","span":[2107,2140],"category":"USAGE","role":"EXCEPTION","source":"gold"},{"id":"c4","span":[2246,2291],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c5","span":[2869,2899],"category":"PLATFORM","role":"REQUIRED","source":"gold"},{"id":"c6","span":[2904,2929],"category":"CONFIGURATION","role":"NOT_REQUIRED","source":"gold"},{"id":"c7","span":[2948,2975],"category":"PLATFORM","role":"EXCEPTION","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'not affected' carve-outs explicit. Severity rationale excluded."} +{"advisory_id":"GHSA-vx2m-gpq4-8j5q","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"18cb26d76e43c70528419c187891850587ebc43a46a62b8484ca31c306277cfc","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[316,343],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c2","span":[633,662],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R6: --global-registry and the LaunchAgent widen scope only. Write endpoints are stated as defended."} +{"advisory_id":"GHSA-w828-4qhx-vxx3","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"e41b9557fac171c5247f214cb34eac9e49480be72d303785bd86d8768b9fea4b","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[93,127],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[312,364],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c3","span":[469,507],"category":"USAGE","role":"EXCEPTION","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'was not affected' is an explicit carve-out."} +{"advisory_id":"GHSA-wcr3-gm9f-f87q","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"b748ae3aea2bb5d95d505ab6739e5679082c5980dac7ec9b0646d84d1958943e","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[212,269],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[334,362],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c3","span":[581,624],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Separate sentences, not grouped."} +{"advisory_id":"GHSA-wh2j-26j7-9728","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"a74b0532a74b4b31b07191d143cef7277ceb8b09a29416ff4361e443c49312ca","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[111,132],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[358,429],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'unauthenticated' is fused. Service-side patch note."} +{"advisory_id":"GHSA-wjmf-p669-5m5p","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"b8a4f2960e0800029ff2531e1fecc72f890252574aa4dc55f6cfbca9118b75ab","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[493,560],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[570,625],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[{"operator":"ALL","members":["c1","c2"]}],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'and then' in one sentence."} +{"advisory_id":"GHSA-wjrh-hj83-3wh7","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"b221e262e6326569491f0c01b55154f9a46343a5c29e7032c9e5cb32d0ea1a3a","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[79,120],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[439,520],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'limited use cases where' is explicit, though placed under Workarounds."} +{"advisory_id":"GHSA-x3r6-ccvq-cf5v","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"fcb97cf9c0728832bc2f0f5fa90093ab146a1a2f1563ab624aa23208667b132f","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[177,193],"category":"PLATFORM","role":"REQUIRED","source":"gold"},{"id":"c2","span":[280,307],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c3","span":[360,377],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Default-install note is evidence."} +{"advisory_id":"GHSA-x3vf-39hj-gxr4","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"b37b73f5da15f70fb0cfa6d5c0822d9bc974f761ea8138a878347397cd755cda","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[79,89],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[91,101],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Title and body repeat."} +{"advisory_id":"GHSA-x5g3-w747-2h8q","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"db72bed6b3669a543e9b46901f4ac2a8cb5a267cbebc23bfc3063d5316657e2d","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[55,71],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[83,104],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c3","span":[153,159],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. SSRF and XSS variants have no extra conditions. Permission workaround excluded."} +{"advisory_id":"GHSA-x6p3-76f2-xxvh","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"d19fe11357b6edd4953a08399e5d3d53c75ac3cf5cb3263f3fa0e518900ccd04","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[59,69],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[134,168],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c3","span":[264,289],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Workaround excluded."} +{"advisory_id":"GHSA-x9vc-9ffq-p3gj","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"486abbce2058156b914173397badd598a0173d7cf76f79f71a86fd7b521d5bfd","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[77,86],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c2","span":[147,156],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c3","span":[192,218],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c4","span":[7143,7217],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c5","span":[7335,7345],"category":"ACCESS","role":"NOT_REQUIRED","source":"gold"},{"id":"c6","span":[7885,7973],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c7","span":[7979,8041],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c8","span":[8046,8097],"category":"PLATFORM","role":"REQUIRED","source":"gold"}],"groups":[{"operator":"ALL","members":["c6","c7","c8"]}],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'Who is impacted' sentence links all three with 'with ... and'. 'Unauthenticated' is fused. PoC excluded."} +{"advisory_id":"GHSA-xhcr-cqfr-m3hv","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"f64ecd8917cac6879688edc455bb05031165ceaa931e4ddd2033ec892a5037dc","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[440,469],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c2","span":[473,498],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c3","span":[727,764],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c4","span":[861,871],"category":"CONFIGURATION","role":"EXCEPTION","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Required absence keeps its negation. '(The https path is sound' is an explicit carve-out."} +{"advisory_id":"GHSA-xjhm-gp88-8pfx","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"a80541f837195b6906d61774c514a0e4b799d064356f5f3fb851937ffb490d4d","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[76,101],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c2","span":[466,491],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c3","span":[547,572],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c4","span":[683,746],"category":"ACCESS","role":"UNCERTAIN","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R4: 'hopes for' hedges the exfiltration step. '(Copier's default setting)' is evidence."} +{"advisory_id":"GHSA-xpww-f6pm-cfhq","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"87902da236ef02a4361ba073fde0d7fd0b7198ebc007301725187eaca6284dc7","preprocessing_version":"1","annotation_version":"batch-04","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[6348,6408],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c2","span":[6425,6497],"category":"PLATFORM","role":"REQUIRED","source":"gold"}],"groups":[{"operator":"ALL","members":["c1","c2"]}],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-04-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'must be able to ... and must have' in one sentence. Prompt-injected agent is an example."} diff --git a/annotations/batches/batch-04_report.md b/annotations/batches/batch-04_report.md new file mode 100644 index 0000000..2cecfb0 --- /dev/null +++ b/annotations/batches/batch-04_report.md @@ -0,0 +1,49 @@ +# Annotation import report + +Generated by `triggermap annotate import`; do not edit by hand. + +- Tasks in export: 138 +- Records written (no issues): 138 +- Tasks with issues: 0 + +## Label counts (clean records) + +| Document status | Count | +|---|---:| +| HAS_CONDITIONS | 132 | +| NO_EXPLICIT_CONDITION | 6 | + +| Category | Count | +|---|---:| +| ACCESS | 89 | +| CONFIGURATION | 55 | +| PLATFORM | 39 | +| USAGE | 157 | + +| Role | Count | +|---|---:| +| EXCEPTION | 11 | +| NOT_REQUIRED | 15 | +| REQUIRED | 284 | +| UNCERTAIN | 30 | + +| Group operator | Count | +|---|---:| +| ALL | 13 | +| ANY | 1 | + +Conditions per condition-bearing document: 2.0 + +## Origin (clean records) + +| Origin | Count | +|---|---:| +| model_draft_accepted | 138 | + +- Draft model `model-batch-04-guidelines-0.2`: 138 records + +Records with origin `model_draft_accepted` carry a model's labels unchanged, and `model_draft_revised` records were changed with no annotation time recorded (not evidence of human editing). Scores against either measure agreement with the drafting process, not accuracy; report them separately from `manual` records. + +## Pace + +No lead times recorded. diff --git a/annotations/batches/batch-07.jsonl b/annotations/batches/batch-07.jsonl new file mode 100644 index 0000000..9ad806b --- /dev/null +++ b/annotations/batches/batch-07.jsonl @@ -0,0 +1,100 @@ +{"advisory_id":"GHSA-29gw-9793-fvw7","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"3ecc99d6c0ac25e2a13312b5d52fc9bdf1e51d57facc4950e6c00dc2bd9c0637","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[44,58],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[352,373],"category":"USAGE","role":"UNCERTAIN","source":"gold"},{"id":"c3","span":[377,384],"category":"PLATFORM","role":"REQUIRED","source":"gold"},{"id":"c4","span":[390,438],"category":"PLATFORM","role":"REQUIRED","source":"gold"},{"id":"c5","span":[855,891],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c6","span":[907,943],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[{"operator":"ALL","members":["c2","c3","c4"]},{"operator":"ALL","members":["c5","c6"]}],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R8: this function = set_term_title, named outside the paragraph, so UNCERTAIN. 'only vulnerable when ... in ... where' and 'If ... and' are explicit."} +{"advisory_id":"GHSA-2ch8-f849-pjg3","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"476eb47d24e4dc0c9512ce4bd8823f126969d9372b503c38c9a535649e2f2af7","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[118,154],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. PATH_INFO is the vector; borderline as internal."} +{"advisory_id":"GHSA-2jg5-xgvv-4wq7","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"d065d53fc66dc618142f5e254a76a86b053c792707dd948f92391acdcd2c1acd","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[100,136],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c2","span":[382,416],"category":"CONFIGURATION","role":"UNCERTAIN","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R4: localhost default limits exploitation; other interfaces widen it."} +{"advisory_id":"GHSA-2q8v-3gqq-4f8p","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"579ee3ff48a8532b765e34d7387bbab20d7b456d2511b97065f5d37cca0753a2","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[0,15],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[2373,2410],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c3","span":[5389,5412],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c4","span":[5417,5489],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'we require' is explicit. Immutables PoC is a variant, left out."} +{"advisory_id":"GHSA-2vpq-fh52-j3wv","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"63786fce5ae3d8c2b25e3e01b7e91e6f1562547f6b8ec1f5908fc07726c95206","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[58,70],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[171,228],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c3","span":[536,572],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R8: these arguments named in the same paragraph."} +{"advisory_id":"GHSA-373w-rj84-pv6x","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"784c26aac5f8cdba9d2a5c89caf6e1a3accc884071545b63741c95068098c1bb","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[75,99],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c2","span":[348,410],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Trailing-dot FQDN is payload (R1)."} +{"advisory_id":"GHSA-3j5x-7ccf-ppgm","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"b591a67a21d03b834698f2e6478fba68866b2763d42fa8fa298bedec69ae7fb4","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[102,109],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c2","span":[234,277],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Victim action stays ACCESS (R3)."} +{"advisory_id":"GHSA-3m2g-v7jf-7fxc","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"2ae7d9f14a0fb1b2f057eacfc4656364d6a17476e8e8398d33826dbd79a246d9","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[174,193],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c2","span":[349,422],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Overwriting SQL is the method."} +{"advisory_id":"GHSA-3pmh-24wp-xpf4","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"aec7050750b75ea10bb863522863fd22e2dc0b751d1529d8ec9f106543aebc61","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"NO_EXPLICIT_CONDITION","conditions":[],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. API access with no stated condition."} +{"advisory_id":"GHSA-3qgw-p4fm-x7gf","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"bffb96f23173fcb42919bf71e49058a2fee71286e776285327b3f874e03d7e44","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[63,79],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[112,145],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Code example excluded."} +{"advisory_id":"GHSA-3vpf-mcj7-5h38","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"1d031f50076f1016591829a12803a3704815a53f8b72d718a793c61ab0bab485","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[1128,1298],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c2","span":[1517,1588],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'Only ... are vulnerable' is explicit. R6: file:// context limits impact."} +{"advisory_id":"GHSA-428g-f7cq-pgp5","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"b316f0ab6ef9754b6e43a955c308efa2006c1d62539d77458d994ed41c8f0531","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[50,78],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Workaround code excluded."} +{"advisory_id":"GHSA-43jf-985q-588j","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"109c7ba03c2705be13b01c00f95a6894924c9c6467ee1c877357ada97e764860","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[108,129],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Stated attacker capability."} +{"advisory_id":"GHSA-4822-jvwx-w47h","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"1ad62d0473c9a664721d452d2e8ffa5d59e7447dbba6af75178e4aa2b9f75b00","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[88,121],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R6: room size scales impact. Workaround excluded."} +{"advisory_id":"GHSA-4j5j-58j7-6c3w","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"778239d74aadad285aea50e003a21ccbf51397a63b7c13bc4aa3e4b1c68fbf0d","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[88,118],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[223,271],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c3","span":[308,335],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R1 input kind."} +{"advisory_id":"GHSA-4mqg-h5jf-j9m7","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"936b92cfaae2a6d55175b9ee9f173f7737df2d378185c601338259c74efb9640","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"NO_EXPLICIT_CONDITION","conditions":[],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Vulnerable bundled dependency with no stated deployment condition; 'Pre-Auth' is in the title only."} +{"advisory_id":"GHSA-4mrx-6fxm-8jpg","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"0db0b4d3bbaf3a137eb67933a4945026df4e5da1caa00d8f893f324be5008479","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[33,95],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. .vy interfaces are a workaround."} +{"advisory_id":"GHSA-4vvc-r4p4-qgrr","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"e9a8d72e4d619f9fda11f794eea23d190687cde8c4e8a656236dda17bab28faf","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"NO_EXPLICIT_CONDITION","conditions":[],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Only workaround settings are given."} +{"advisory_id":"GHSA-4x4j-2g7c-83w6","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"57bae3e3a56e206397f7eaccce4998349a57a45b01efa661b5bb05d01ff7c01b","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[8,35],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[463,491],"category":"USAGE","role":"EXCEPTION","source":"gold"},{"id":"c3","span":[551,580],"category":"USAGE","role":"EXCEPTION","source":"gold"},{"id":"c4","span":[596,603],"category":"PLATFORM","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. macOS and Linux viewers are stated as safe."} +{"advisory_id":"GHSA-555p-6grf-mh7f","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"158f2b919cfc41827f933bb043d5f5aff495b71714db123b9679961c59d818ca","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[460,484],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[1079,1169],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Windows filename failures are a related non-security issue. Workarounds excluded."} +{"advisory_id":"GHSA-5jc6-h9w7-jm3p","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"57456000bf2605b2d39dc2a3547d26dbb8f3d8ba128affd56d16300a8f8fd3e6","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[152,203],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c2","span":[305,344],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Victim action stays ACCESS (R3)."} +{"advisory_id":"GHSA-5jrq-582v-9767","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"3b1b91294928e578ba31c368d91250fb4b103e275de93f408b8556224c3321a2","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"NO_EXPLICIT_CONDITION","conditions":[],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Internal C functions only."} +{"advisory_id":"GHSA-5m98-qgg9-wh84","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"deed10580a94ea694b8b25287ba311cf8af5e1aab66aa0a4748f023fcafb444b","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[110,169],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c2","span":[180,207],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R8: it = the request, same paragraph."} +{"advisory_id":"GHSA-5rp4-749p-vx26","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"1e71e2c63814d7f40caf3f80e1034b9567da012c4105ffdff9c108f8250995b5","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"NO_EXPLICIT_CONDITION","conditions":[],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Unnecessary formatting is mechanism."} +{"advisory_id":"GHSA-5wvp-7f3h-6wmm","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"35182efd918eab60944a618b619f1e40f8262bf614edc764506c80ec9609fc02","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[107,130],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[236,339],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Other Arrow implementations are other packages. Hotfix is a workaround."} +{"advisory_id":"GHSA-63cw-57p8-fm3p","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"b052edc2cb89921db915b0332c18919e74b79f1d2fd8e419b91dffe4f90c5891","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[211,257],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[657,708],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Here the safe-mode unpickler is the vulnerable path, so REQUIRED."} +{"advisory_id":"GHSA-63xm-rx5p-xvqr","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"9e31d6d602b871ea302d536920c7b690e126ba97ef28a16824afa1d4ac092604","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[65,88],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Named op."} +{"advisory_id":"GHSA-6667-f46p-pg88","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"d3dfe9420f5f636cac7b85e61ea30e8b5e607aa21e815312c52828b0bd315e9d","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[129,140],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c2","span":[238,299],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R4: 'opportunistic circumstances' names nothing checkable. Entity text kept as in the source."} +{"advisory_id":"GHSA-67cx-rhhq-mfhq","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"c92dbabafefffe0299eb2fd5a90223044493194e4055dd1dd35da9ba69701ba7","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[722,741],"category":"CONFIGURATION","role":"EXCEPTION","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Workaround paragraph states it cannot be abused without xelatex; reviewer should check."} +{"advisory_id":"GHSA-69w3-r845-3855","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"f38def764251901b662cce1f66a2620734f774744ba3697365d6556eb74ee7f7","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[160,173],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[419,455],"category":"PLATFORM","role":"REQUIRED","source":"gold"},{"id":"c3","span":[583,620],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Dependency version is an environment condition, not the package's own range."} +{"advisory_id":"GHSA-6wcr-wcqm-3mfh","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"ba2f2b855a7c2d9f0faa380850d5130fd2c0576fe585bdc8b8adf951e7a74772","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[24,44],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[50,89],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Settings key is payload (R1)."} +{"advisory_id":"GHSA-756h-r2c9-qp5j","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"91c781afcd6fc5005be25381d1594a607603787bd9dc2e3bb8784fec4acac482","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[3,21],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c2","span":[74,92],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Title and body repeat."} +{"advisory_id":"GHSA-765j-9r45-w2q2","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"f79a96482691933b147014c9fd7594093ee7c8bc0d3fc852ed4eaef56b0a4a95","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[66,91],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c2","span":[125,200],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c3","span":[331,343],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Disabled-after-the-fact is impact. Workarounds excluded."} +{"advisory_id":"GHSA-7c2f-r6gc-h92h","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"435123770617aa7649430c53ef3af6aa9187c870b5ceded0f63ab74765de40aa","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[193,250],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c2","span":[388,431],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Masking default is mechanism."} +{"advisory_id":"GHSA-7pq6-v88g-wf3w","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"31b7211900c61f89f2ca8b8430ca5028b095f15900abf911eb8b6265ee1ef7a3","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[306,391],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c2","span":[397,431],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c3","span":[555,628],"category":"CONFIGURATION","role":"EXCEPTION","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'no action is needed' is an explicit carve-out."} +{"advisory_id":"GHSA-7wqf-h36w-47mc","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"80e87eafd1236919742575d34508897c4719a132aeecb422435afecf5c24563f","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[148,177],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[281,306],"category":"ACCESS","role":"NOT_REQUIRED","source":"gold"},{"id":"c3","span":[449,491],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Upgrade note excluded."} +{"advisory_id":"GHSA-7wxf-r2qv-9xwr","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"5407bc24e42d759adee0d27cbb2ff6accbddb5dd62c0f5048af9a33e84810067","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"NO_EXPLICIT_CONDITION","conditions":[],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Open redirect with no stated condition."} +{"advisory_id":"GHSA-7xr3-6ggc-wc9p","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"dd8b9de730d863ba644f89659d85b349c26796b54483615339e5e4525a7786d3","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"NO_EXPLICIT_CONDITION","conditions":[],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Entity expansion with no stated condition."} +{"advisory_id":"GHSA-7xxv-wpxj-mx5v","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"6c65f7413554fd7cb6e032d32b84266511bde240e54a191a67b36b0ac94d6efd","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[122,182],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c2","span":[204,214],"category":"ACCESS","role":"NOT_REQUIRED","source":"gold"},{"id":"c3","span":[305,369],"category":"USAGE","role":"UNCERTAIN","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R4: 'could be a concern, for example' hedges the service case."} +{"advisory_id":"GHSA-8434-v7xw-8m9x","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"b695e2b7809577e82dc72a9aae38be937b42c9c2bb93c1ab5e6934f5a2b3e0ec","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[125,155],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c2","span":[193,237],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R1 input kind."} +{"advisory_id":"GHSA-8c4w-v65p-jvcv","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"fe3d8370015d44f018fa0aeb7e5581145b76e7c6d6bf74dec255f1c553a94239","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[355,392],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c2","span":[407,433],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Byte manipulation is payload (R1)."} +{"advisory_id":"GHSA-8f8m-wrvr-wcvf","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"624eb8109929f8e315b65431c922e1fe4c64ed75e71255660a1f2b5231f8c692","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[210,254],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[389,453],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Impersonation is impact."} +{"advisory_id":"GHSA-8qxj-f9rh-9fg2","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"1e15f59edda6c140925682894f3fc9c1c889ea26ce3c27a818853249a8b41344","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"NO_EXPLICIT_CONDITION","conditions":[],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Malformed signatures are payload (R1)."} +{"advisory_id":"GHSA-8wwf-2644-f8x4","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"ab1762ebad1a1afc815342dcddbc700e3a5c229f47a81f9500a7c3a9c9105fed","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[242,272],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Named feature."} +{"advisory_id":"GHSA-966j-vmvw-g2g9","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"32f0d77aa912bd24eccbe06dea3880c9905de4dbd126fa71169dc23e33b10574","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[93,134],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Stated with 'When'."} +{"advisory_id":"GHSA-9x4q-3gxw-849f","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"9c623dca8977954247756cd8e438a85e8dcbcb03f54bdc20e3a01daa4ce1facf","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[94,131],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R6: impact discussion only."} +{"advisory_id":"GHSA-9x6q-5423-w5v9","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"f254bb806b4de9e178cbf04265b2251bd50bc50cd433706120b64015e544ee24","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[99,132],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Stated attacker position."} +{"advisory_id":"GHSA-9xwg-3r6f-jcx2","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"b6fc1d8a28435d808c6a1de13fe2c75acec0a19a78d6d0a604168e6334109073","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[42,55],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[2887,2939],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c3","span":[3046,3067],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R6: image-extension check bounds impact. Traversal paths are payload (R1)."} +{"advisory_id":"GHSA-ccgm-3xw4-h5p8","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"18ce893540062c667fa7f355fa78bc9fbec31973df0e89b19f837963458919a8","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[155,183],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Stated with 'when'."} +{"advisory_id":"GHSA-cj7g-h7rf-h8j9","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"171f5f0c2bbb3e42c5b8d1328d6e601d94293ccea12a6baf4b6a159ce20d33b6","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[117,135],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c2","span":[173,194],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. os access is impact."} +{"advisory_id":"GHSA-cw7j-v52w-fp5r","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"3059e99a8be028a17b855b2565ea542438a7406e3d95038d0d017cd87cd12e26","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[241,254],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[343,389],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. hc parameter is the vector. Log-grepping advice excluded."} +{"advisory_id":"GHSA-f66q-9rf6-8795","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"5971f4bfb1ab39a080d709ae50740143bd2b0012ab6bfe0757b507fad26c7224","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[475,560],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c2","span":[967,1027],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c3","span":[1029,1150],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c4","span":[1180,1267],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c5","span":[27520,27546],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"}],"groups":[{"operator":"ALL","members":["c2","c3"]}],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Gadget examples are parenthetical. PoC excluded."} +{"advisory_id":"GHSA-fpmr-qmgh-42x2","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"544f501faf697889e1e6afc96d4373fe126e52917ca05fb74a2010216bdf8b75","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[44,102],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c2","span":[220,266],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Victim action stays ACCESS (R3)."} +{"advisory_id":"GHSA-frgf-rv99-862x","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"d85c6d1a77826c01de8f4d06f8ced3be5e139651300130e9f7d657e81c13680f","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"NO_EXPLICIT_CONDITION","conditions":[],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Template argument is the injection vector (R1); nothing beyond using the package (section 8)."} +{"advisory_id":"GHSA-fxff-wxxv-c2jc","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"db20e6ebec45798e5cb26ed0cc8af5a0acd36e4fe5ebd1b52ae877a699d718dc","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"NO_EXPLICIT_CONDITION","conditions":[],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Static IV is mechanism."} +{"advisory_id":"GHSA-g95c-2jgm-hqc6","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"b981904b02da5182c36099d72d2c37d163e7e0bc214e33329e909cb9a3b037ed","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[179,212],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[441,514],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'limited to' is explicit."} +{"advisory_id":"GHSA-g9wf-5777-gq43","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"0dbc3fd34c863de5687c95bb01164d21a4b9cd4ed4303dcb1e6ac5116e61bc2c","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[344,383],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c2","span":[2891,2931],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R2: request fields are ACCESS. Gadget chain is PoC and payload."} +{"advisory_id":"GHSA-gjrg-mpp7-g774","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"22671cc586f3457a3ade903e330c67935c75cfb85ad063b6a1f29a9c0db68c0b","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[94,113],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[183,199],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R1 input kind."} +{"advisory_id":"GHSA-gw46-8559-cggp","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"0c3cd33a4b52010a2f810a014f0f4ef155324749b593f4968d9ba2e33b83f260","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[174,210],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Weak permissions are mechanism."} +{"advisory_id":"GHSA-h2fp-xgx6-xh6f","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"8187b3e511a990b7cea7db18654bbaf3b21dfd022d731cf5c85ad5b323b8a5af","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[101,157],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Exception-message field is payload (R1)."} +{"advisory_id":"GHSA-h9fp-p2p9-873q","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"2aa4a0eba9bf5195ebba891864e7bd7c7e179c721fa7d8d70215e41cdceab6d8","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[53,65],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[372,401],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c3","span":[1186,1233],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c4","span":[1418,1491],"category":"PLATFORM","role":"UNCERTAIN","source":"gold"},{"id":"c5","span":[1493,1549],"category":"PLATFORM","role":"UNCERTAIN","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R7: amplifiers apply to escalation only. Payload and PoC excluded."} +{"advisory_id":"GHSA-hjr4-fhgp-23g9","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"8970718c053c277f7102616b5061235e03265c722fc8aad8135aaf8595d4cfbb","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[101,138],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Unsafe YAML load is mechanism."} +{"advisory_id":"GHSA-hxxf-235m-72v3","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"eadd27198c68dc62878d1561b1acc6c011765193306ce198334aa29cb1241918","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[90,100],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[380,427],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'User interaction is required' is explicit."} +{"advisory_id":"GHSA-j257-jfvv-h3x5","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"ff87668d96618ae336c540177c3e9372df6441975c5d82637f40028362ae4007","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[24,43],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Disabling it is a workaround."} +{"advisory_id":"GHSA-jh82-c5jw-pxpc","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"1dd735537b9e9ee95e912b2a66cdafd268bd0825404906e6981fcd5253092c82","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[2552,2578],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Request script is PoC detail."} +{"advisory_id":"GHSA-jjjr-3jcw-f8v6","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"6012e0fcf7747ee4e908d6a21b9d2eb4deab8be1d4fd86df1fcb16878e26fc8d","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[129,198],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c2","span":[319,384],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c3","span":[501,514],"category":"ACCESS","role":"UNCERTAIN","source":"gold"},{"id":"c4","span":[550,641],"category":"CONFIGURATION","role":"EXCEPTION","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R4: parenthetical feasibility hedges network position."} +{"advisory_id":"GHSA-jjw5-xxj6-pcv5","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"02b369dfe664760a01689047e7e3f9729869ceb4f92c11a7e9f1a9f50249b405","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[135,194],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. __reduce__ content is payload (R1). Dispute note is not a condition."} +{"advisory_id":"GHSA-jqqh-999x-w26w","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"01f4b4dba439b736f7c0c55ee546d3076af1cfedf108086efec3b7493313b20e","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[99,150],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'unspecified vectors' names nothing checkable."} +{"advisory_id":"GHSA-jrm8-xgf3-fwqr","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"50516a06d4cd1ea01997322103a1d7c604825a01fa8cdeb7514ad30265ff00dd","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[334,386],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[679,726],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'Exploitation conditions' is explicit. Bundle ID characters are payload (R1)."} +{"advisory_id":"GHSA-m67m-3p5g-cw9j","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"9c5dde3e5af2bc771c428095f33369ae9e9ef58856890819bea99803815ef3e0","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[125,236],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[340,394],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c3","span":[506,527],"category":"PLATFORM","role":"UNCERTAIN","source":"gold"},{"id":"c4","span":[923,958],"category":"PLATFORM","role":"UNCERTAIN","source":"gold"},{"id":"c5","span":[2103,2130],"category":"ACCESS","role":"UNCERTAIN","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R7: logging variant. Browser-history exposure needs no extra condition."} +{"advisory_id":"GHSA-m87f-39q9-6f55","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"d6294b7066b33a1d7610149fa987b6773c5c85dbc84548a969a8cf99861e6c93","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[70,92],"category":"PLATFORM","role":"REQUIRED","source":"gold"},{"id":"c2","span":[220,231],"category":"ACCESS","role":"NOT_REQUIRED","source":"gold"},{"id":"c3","span":[249,267],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R3: error event is PLATFORM. 'do not require root access' is NOT_REQUIRED."} +{"advisory_id":"GHSA-mcmc-c59m-pqq8","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"163ddce4cb5f09b33008f9f5fad5ec4e7353a18fa01317355b656da69b543cd4","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[167,206],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. PoC account and request excluded."} +{"advisory_id":"GHSA-mcpw-cp35-p3h8","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"debc8362d2f89b724dda81b5f1764c4a01b9affca186d2494778f23fbfee27bd","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[426,467],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'Only ... are affected' is explicit."} +{"advisory_id":"GHSA-mpf5-3vph-q75r","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"7751f71aa5dbcb7df0f53da5e4b6a7ea3544f26a63fd0deb99c2240c828f961a","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[79,101],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Named feature. Blocking /api/memory/ is a workaround."} +{"advisory_id":"GHSA-mq26-g339-26xf","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"5a3d3b1a2ea1bec9cd25c5ace8996d7fcde08fc615ab9ca54c589db2d0015605","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[30,49],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[56,101],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c3","span":[415,447],"category":"USAGE","role":"EXCEPTION","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'does not affect users who aren't' is an explicit carve-out; the negation is what holds."} +{"advisory_id":"GHSA-mvf6-hwxh-7v76","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"292c76468fe4fc38943a3cc6fa806e1a0bbb7d7b891d846da3fa94368ca2fa2f","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[50,64],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Stated usage context."} +{"advisory_id":"GHSA-mxvw-cj37-8g2h","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"01c8a0f25738379db1af9fe9b38324edfbcb1d2e0bb20dd299c3151d8031b664","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[170,200],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Query parameter is the vector."} +{"advisory_id":"GHSA-p28x-hj68-7vfp","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"7d814e77c7920336fa335895abbdf0a9c8dcd240baef21bc0078e0b0df76709b","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[60,68],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Named public message class; borderline, as in batch 03."} +{"advisory_id":"GHSA-p43w-g3c5-g5mq","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"d4082fafbc9e08145721286d9114162ee6c6f3d6def6f7728df3784dbe4ebec5","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"NO_EXPLICIT_CONDITION","conditions":[],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Internal decoder file only."} +{"advisory_id":"GHSA-p4v8-rw59-93cq","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"efb3ade14b3dbeba688a0e3d53d5380684a67da4fe9ce4cd9960cc7c17373a56","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[182,223],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[227,269],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c3","span":[331,375],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'Not exploitable by an ordinary site visitor' restates the requirement. Crafted title is payload."} +{"advisory_id":"GHSA-pw27-w7w4-9qc7","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"0827c617a88fa8e7457d930e4facb862333472f4c2ccf486f7b54eec86877d77","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[30,61],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Basic-auth URL is payload (R1)."} +{"advisory_id":"GHSA-pw3c-h7wp-cvhx","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"260db8a42e46b83e8e50885ccf4be20d1e443dfc34f333d7a4968963b74d11d5","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[162,176],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Named public class; borderline."} +{"advisory_id":"GHSA-pwgv-4x5q-6m9f","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"6017e184b19eedc91dced2407a913063ccf173569f73b90df221f68d70447db7","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[241,262],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[2847,2928],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c3","span":[3079,3090],"category":"CONFIGURATION","role":"NOT_REQUIRED","source":"gold"},{"id":"c4","span":[3145,3168],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R1: nesting shapes are payload. 'There is no opt-in flag' is NOT_REQUIRED. Consumer examples excluded."} +{"advisory_id":"GHSA-q3qx-c6g2-7pw2","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"bcf408f6185b8afe5e482515e6fcdc939a9cf32a8c5add93db8e553fc1b92ae2","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[10,23],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[228,262],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c3","span":[310,383],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c4","span":[403,446],"category":"USAGE","role":"UNCERTAIN","source":"gold"},{"id":"c5","span":[572,624],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R4: 'For example' makes the JSON case UNCERTAIN. Separate sentences, not grouped."} +{"advisory_id":"GHSA-q9h8-gpw5-c95c","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"ca1ca6294625c9235f006f22f243e41e2c2146cd3dcb7e57108dacf89de08c0b","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[93,150],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c2","span":[159,196],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. No explicit operator, so not grouped."} +{"advisory_id":"GHSA-qhmp-h54x-38qr","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"4ee78bdd8f8f59e0132d59041c0556e26d956c6726012efe381f17a03b6d1c46","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[43,55],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[71,166],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Removing the plugin is a workaround."} +{"advisory_id":"GHSA-qjmc-wwmw-cq9r","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"9b11d3c6205c9dd5adcd378a01b9adc85feaa87914e3582a6348aa4d872534ac","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[83,89],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[158,172],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Path separators are payload (R1)."} +{"advisory_id":"GHSA-r6h7-5pq2-j77h","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"e119504935330acd09ca273df7cca9d67608ebd9147e07c4abba9a8bf181a23c","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[117,159],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Template caching is mechanism."} +{"advisory_id":"GHSA-r8g9-w4f3-9crm","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"29ed6080135d73c68b3470f67b2cefa5b761ff232e7866421f04f1974fb70cd9","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"NO_EXPLICIT_CONDITION","conditions":[],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. mdb_node_del is an internal C symbol."} +{"advisory_id":"GHSA-rg9q-m8hv-xxr6","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"f7702a3a9c4d319cac3b6a2e722781850c7bffe28ef2c6f4cf97eded4949b8ad","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[61,72],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Named public API."} +{"advisory_id":"GHSA-rjxg-rpg3-9r89","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"fa90ad965ff39cb6d1d4c5dac5df52b1d5e29dc3c7a4cf90bb4c4326d6e2b206","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[151,177],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[637,688],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Filtered config contents are impact."} +{"advisory_id":"GHSA-rpc6-h455-3rx5","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"8889ecbf85aa594679dde508c9247792190c6b9ed1a4f5da1e3b209228e5d446","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[173,275],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c2","span":[290,301],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Crafted worker code is payload (R1)."} +{"advisory_id":"GHSA-v4w5-p2hg-8fh6","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"6cd97425cb954767063747b460850bce86c74163b58fe6a24ba16232b0bcbdf3","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[430,526],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c2","span":[540,573],"category":"PLATFORM","role":"REQUIRED","source":"gold"}],"groups":[{"operator":"ALL","members":["c1","c2"]}],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'who are using ..., and who are using' is explicit. 'certain configurations' is resolved by the list."} +{"advisory_id":"GHSA-vc3v-ppc7-v486","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"5c8158b196498f068252c26ab381a1439128bba99899404ac69191829c3dd062","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[163,203],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c2","span":[428,471],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Fake parent_id is payload (R1)."} +{"advisory_id":"GHSA-vfg9-phjp-9frw","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"619053a1ed222f0081815129569b7cc83c240512df39d74de9ff34f78c902514","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"NO_EXPLICIT_CONDITION","conditions":[],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. came_from parameter is the injection vector (R1)."} +{"advisory_id":"GHSA-vp6v-whfm-rv3g","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"d3b58b11d93ff42fa9d725cf220956e156f86bc4c8069ce4d4036dab5c433c2b","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[159,197],"category":"CONFIGURATION","role":"REQUIRED","source":"gold"},{"id":"c2","span":[201,239],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[{"operator":"ANY","members":["c1","c2"]}],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Explicit 'or'. Ghostscript and decoder workarounds excluded."} +{"advisory_id":"GHSA-vp96-hxj8-p424","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"c44492bc9a531e8d7af874721a61651cfd051c97009a57bc45de019ed2e305ce","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[112,198],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[264,324],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. R8: this callback named in the previous sentence of the paragraph."} +{"advisory_id":"GHSA-vxq7-64xx-v4gw","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"fbf96c3166cdccff60aef935a38cffc26584b5aec9156c197a53796cd30a5695","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[417,438],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c2","span":[1149,1200],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c3","span":[1233,1295],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c4","span":[1316,1338],"category":"USAGE","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. read() is a workaround."} +{"advisory_id":"GHSA-w446-h7vg-wv3p","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"3627948fd97b0f3ea2789426c61c7bf9b5c4e1c18b36bba4c689e4e6b5387931","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[151,176],"category":"ACCESS","role":"REQUIRED","source":"gold"},{"id":"c2","span":[337,376],"category":"ACCESS","role":"REQUIRED","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. Invalid project query is payload (R1)."} +{"advisory_id":"GHSA-xgxc-v2qg-chmh","source_commit":"1912cbd6ce9d4cb141636adc4abafb4eb77a93e6","content_hash":"ddda3f85636b52bd5c35bf87498e918fbb5fb80250de498cd995359423631079","preprocessing_version":"1","annotation_version":"batch-07","schema_version":"1.2","document_status":"HAS_CONDITIONS","conditions":[{"id":"c1","span":[101,116],"category":"USAGE","role":"REQUIRED","source":"gold"},{"id":"c2","span":[198,222],"category":"USAGE","role":"EXCEPTION","source":"gold"}],"groups":[],"annotator":"A1","adjudicated":false,"origin":"model_draft_accepted","origin_model":"model-batch-07-guidelines-0.2","notes":"MODEL ANNOTATION — owner-authorized submission; no independent human adjudication. Frozen guidelines v0.2. 'were not affected' is an explicit carve-out. Crafted names are payload."} diff --git a/annotations/batches/batch-07_report.md b/annotations/batches/batch-07_report.md new file mode 100644 index 0000000..94550c4 --- /dev/null +++ b/annotations/batches/batch-07_report.md @@ -0,0 +1,69 @@ +# Annotation import report + +Generated by `triggermap annotate import`; do not edit by hand. + +- Tasks in export: 100 +- Records written (no issues): 100 +- Tasks with issues: 0 + +## Label counts (clean records) + +| Document status | Count | +|---|---:| +| HAS_CONDITIONS | 87 | +| NO_EXPLICIT_CONDITION | 13 | + +| Category | Count | +|---|---:| +| ACCESS | 65 | +| CONFIGURATION | 23 | +| PLATFORM | 10 | +| USAGE | 84 | + +| Role | Count | +|---|---:| +| EXCEPTION | 7 | +| NOT_REQUIRED | 4 | +| REQUIRED | 161 | +| UNCERTAIN | 10 | + +| Group operator | Count | +|---|---:| +| ALL | 4 | +| ANY | 1 | + +Conditions per condition-bearing document: 2.0 + +## Origin (clean records) + +| Origin | Count | +|---|---:| +| model_draft_accepted | 100 | + +- Draft model `model-batch-07-guidelines-0.2`: 100 records + +Records with origin `model_draft_accepted` carry a model's labels unchanged, and `model_draft_revised` records were changed with no annotation time recorded (not evidence of human editing). Scores against either measure agreement with the drafting process, not accuracy; report them separately from `manual` records. + +## Label mix against earlier gold + +- Reference: 460 records from `annotations/pilot/pilot-2.jsonl`, `annotations/batches/batch-01.jsonl`, `annotations/batches/batch-02.jsonl`, `annotations/batches/batch-03.jsonl`, `annotations/batches/batch-06.jsonl`, test split excluded (manual 18, model_draft_accepted 414, model_draft_revised 28) +- Flagged: |z| ≥ 3 and a share gap of at least 5 points. A flag is a reason to look, not an error. Conditions cluster within documents, so z overstates certainty: treat it as a screen, not a test. + +| Group | Label | This batch | Reference | z | Status | +|---|---|---:|---:|---:|---| +| Role | REQUIRED | 161 (88.5%) | 1311 (75.0%) | +4.1 | **shift** | +| Role | EXCEPTION | 7 (3.8%) | 61 (3.5%) | +0.2 | | +| Role | NOT_REQUIRED | 4 (2.2%) | 114 (6.5%) | -2.3 | | +| Role | UNCERTAIN | 10 (5.5%) | 262 (15.0%) | -3.5 | **shift** | +| Group operator | ALL | 4 (80.0%) | 136 (77.7%) | +0.1 | | +| Group operator | ANY | 1 (20.0%) | 31 (17.7%) | +0.1 | | +| Group operator | UNRESOLVED | 0 (0.0%) | 8 (4.6%) | -0.5 | | +| Document status | HAS_CONDITIONS | 87 (87.0%) | 431 (93.7%) | -2.3 | | +| Document status | NO_EXPLICIT_CONDITION | 13 (13.0%) | 28 (6.1%) | +2.4 | | +| Document status | UNSUPPORTED_STRUCTURE | 0 (0.0%) | 1 (0.2%) | -0.5 | | + +Shifted: REQUIRED 75.0% → 88.5%, UNCERTAIN 15.0% → 5.5%. Check a sample of these labels against the guidelines before training on this batch. + +## Pace + +No lead times recorded. diff --git a/docs/annotation_plan.md b/docs/annotation_plan.md index 7f848a2..c53688a 100644 --- a/docs/annotation_plan.md +++ b/docs/annotation_plan.md @@ -10,10 +10,10 @@ in `splits/pool-v1.json` (see [`splits.md`](splits.md)). Every batch is committe | `batches/batch-01.json` | train | 100 | natural | train | done under v0.2 (`batch-01`; model drafts, no `manual` records) | | `batches/batch-02.json` | train | 100 | enriched (cue top quartile, ≤ 800 words) | train | done under v0.2 (`batch-02`; model drafts, no `manual` records) | | `batches/batch-03.json` | dev | 112 | natural, ≤ 3 per leakage group | dev | done under v0.2 (`batch-03`; model drafts, no `manual` records) | -| `batches/batch-04.json` | test | 138 | natural, ≤ 2 per leakage group | test | **last**, after guidelines are frozen | +| `batches/batch-04.json` | test | 138 | natural, ≤ 2 per leakage group | test | done under v0.2 (`batch-04`; model drafts, no `manual` records) | | `batches/batch-05.json` | train | 261 | 183 uncertainty from `crf-batches-01-02` + 78 natural, ≤ 3 per leakage group | train | next (drawn 2026-11-05) | | `batches/batch-06.json` | dev | 60 | natural, ≤ 3 per leakage group | dev | done under v0.2 (`batch-06`; model drafts, no `manual` records) | -| `batches/batch-07.json` | dev | 100 | natural, ≤ 3 per leakage group | dev (calibration, thresholds, regression checks) | by hand, before batch-04 (drawn 2026-11-07) | +| `batches/batch-07.json` | dev | 100 | natural, ≤ 3 per leakage group | dev | done under v0.2 (`batch-07`; model drafts, no `manual` records) | Totals when complete: train 39 + 100 + 100 + 261 = 500; dev 38 + 112 + 60 + 100 = 310; test 12 + 138 = 150. Batch-06 was added to give dev hand-labelled documents, but it was @@ -52,7 +52,7 @@ data only. Only `manual` records count toward evaluation (see [`targets.md`](tar ## Label source decision (2026-11-05) -Batches 01, 02, 03 and 06 were all submitted from model drafts. The owner decided to continue +Batches 01, 02, 03, 04, 06 and 07 were all submitted from model drafts. The owner decided to continue with model-drafted labels instead of hand labelling. Results against them are reported as agreement with the drafting model, and the release gates in [`targets.md`](targets.md) cannot be judged as declared. If hand labelling resumes, the procedure below still applies. @@ -78,6 +78,11 @@ the earlier file. ## Hand-labelled dev and test batches (batch-07, batch-04) +**Status (2026-11-09):** both batches were submitted from model drafts by the owner's decision, +so neither adds `manual` records. The drafting process read the batch-04 test texts; nothing +was tuned or scored on them. The plan below applies only if hand labelling resumes, in fresh +projects created from the task files. + The release gates in [`targets.md`](targets.md) are judged on `manual` records only. Two batches make them judgeable, labelled by hand with the procedure above: diff --git a/docs/dataset_card.md b/docs/dataset_card.md index d40bea7..386f8bc 100644 --- a/docs/dataset_card.md +++ b/docs/dataset_card.md @@ -82,6 +82,8 @@ provenance only. | `batch-02` | 100 | 0 | 99 | 1 | v0.2 | | `batch-03` | 112 | 0 | 112 | 0 | v0.2 | | `batch-06` | 60 | 0 | 60 | 0 | v0.2 | +| `batch-07` | 100 | 0 | 100 | 0 | v0.2 | +| `batch-04` | 138 | 0 | 138 | 0 | v0.2 | - **`manual`:** labelled by hand in Label Studio, with working time recorded. - **`model_draft_accepted`:** a model pre-annotation submitted unchanged. @@ -121,8 +123,11 @@ Annotated so far, by split: | `batch-02` | 100 | 0 | 0 | 0 | | `batch-03` | 0 | 112 | 0 | 0 | | `batch-06` | 0 | 60 | 0 | 0 | +| `batch-07` | 0 | 100 | 0 | 0 | +| `batch-04` | 0 | 0 | 138 | 0 | -Test records are never read for development, and no test evaluation has been run ([`test-access-log.md`](test-access-log.md) has no entries). +Test records are never read for development. The batch-04 test texts were read once, to draft +their model labels; nothing was tuned or scored on them, and no test evaluation has been run ([`test-access-log.md`](test-access-log.md) has no entries). ## Sampling diff --git a/docs/evaluation.md b/docs/evaluation.md index ebe41e1..64bc884 100644 --- a/docs/evaluation.md +++ b/docs/evaluation.md @@ -77,8 +77,8 @@ Training data can be restricted the same way (`train --origin manual`), and each model bundle records the origins it was trained on (`training_origins` in `metadata.json`). -**Current status (2026-11-05).** Only 22 records are `manual` (10 in dev, 4 in test). Every -batch after the pilot is model-drafted, by the owner's decision, so new results are reported as +**Current status (2026-11-09).** Only 22 records are `manual` (10 in dev, 4 in test). Every +batch after the pilot, including the test batch `batch-04`, is model-drafted, by the owner's decision, so new results are reported as agreement with the drafting model, labelled as such, and the release gates in [`targets.md`](targets.md) cannot be judged as declared. diff --git a/docs/targets.md b/docs/targets.md index e20c9b9..9a4fc7a 100644 --- a/docs/targets.md +++ b/docs/targets.md @@ -10,7 +10,7 @@ allowed once a release evaluation on the test split has been run for the release ## Status (2026-11-05): gates cannot be judged as declared -Every annotation batch after the pilot (batches 01, 02, 03 and 06) was submitted from model +Every annotation batch after the pilot (batches 01, 02, 03, 04, 06 and 07) was submitted from model drafts, and the owner decided on 2026-11-05 to continue with model-drafted labels rather than hand labelling. The gates below are judged on hand-labelled (`origin: manual`) test records, and only 4 test records are hand-labelled, so **no release can be shown to meet them**. The @@ -98,3 +98,4 @@ about 512 tokens, ≤ 8 s at about 2,000 tokens, peak memory ≤ 3 GB, throughpu |---|---| | 2026-11-02 | First declaration, after the pilot and before any test results. | | 2026-11-05 | Status note added: labels after the pilot are model drafts, so the gates cannot be judged as declared. No target changed; the test-access log still has no entries. | +| 2026-11-09 | batch-04 (138 test records) and batch-07 (100 dev records) submitted from model drafts by the owner's decision; hand-labelled test records remain 4. No target changed; the test-access log still has no entries. |