/red-team

Separate four findings that are easy to conflate: affected version, suspected path, confirmed exploit, unknown. A tool name is not proof of unreachability.

Preflight (hard)

• osv-scanner ≥2 on PATH, else stop and print brew install osv-scanner or go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest.
• Exploit reproduction only against a local checkout or a test environment you own. Never against production, third-party hosts, or real credentials. If the target is unclear → ask.

Decision tree

1. Scan (always first) osv-scanner scan source -r --format json --output-file .ramos/red-team/osv.json .

• Exit 0 → no known vulns in the lockfiles found. Report not found within stated coverage and name the lockfiles scanned. Done.
• Exit 1 → vulns found. Go to 2.
• Exit 128 → no scannable package sources (no lockfiles, or lockfiles with zero packages). Report unknown: no scannable package sources and list the files the scanner says it found. Don't claim the repo is clean.
• Other exits → tool error. That's unknown, never a clean bill. Offline: add --offline-vulnerabilities --download-offline-databases. Go/Rust call analysis: --call-analysis=go|rust (Rust runs build scripts, so ask first).