Abdelrahman Mostafa e975cf7171 fix(report): address review findings on CSPT detection ... Resolve the Greptile review on the CSPT PR: - coverage: a bundled skill's sub-topic is only covered by a row from an agent that carried that skill, so an unrelated row (an open_redirect "meta refresh") can no longer mask an untested browser surface - reporting: the CSPT discriminator now requires an endpoint or a code_location that survives _build_physical_locations (a repo-relative file with a start line), so a drive/absolute path SARIF drops no longer passes and leaves the alert locationless and collapsed - sarif: drop the "client-side path traversal" title keyword so existing dynamic reports keep their title token and fingerprint; CSPT is still distinguished by the structured finding_class - dedupe: exempt the default `dynamic` class so an older CSPT filed as dynamic can still dedupe against a client_side_path_traversal report - tests: relabel the fixture regression as a source-to-sink primitive (reaches_sink / no_unguarded_sink), not an exploitability verdict; add a coverage regression for the sub-topic masking fix		2026-10-06 10:59:31 +03:00
..
cspt	fix(report): address review findings on CSPT detection	2026-10-06 10:59:31 +03:00