Summary
Of the findings upheld by Stage 2 in our run, fewer than one in ten carried a CWE classification, an impact statement, or reproduction steps. None carried a suggested fix. There is no severity field in the output schema at all.
Evidence
Across the 82 Stage 2-upheld findings in pipeline_output.json:
| Field populated |
Count |
description |
82 |
cwe_id (non-zero) |
6 |
impact |
6 |
steps_to_reproduce |
6 |
suggested_fix |
0 |
| any severity field |
0 — field does not exist |
The other 76 arrive with cwe_id: 0, name: "vulnerable", short_name: "VULNERABLE", and prose only. The six well-formed findings are richly detailed — CWE, concrete attack path, reproduction — which suggests an extraction or schema-adherence gap rather than a design limit.
Why it matters
Without severity or CWE, findings cannot be ranked, filtered, deduplicated across runs, or mapped to a remediation SLA — and 76 of 82 are mutually indistinguishable in any structured view, forcing reviewers to read prose serially. suggested_fix exists in the schema and was populated zero times.
Suggested fix
Constrain the Stage 1 and Stage 2 outputs with a schema requiring cwe_id, severity and impact, and treat a response missing them as a parse failure to retry rather than a finding to emit. Introducing a severity field at all would be the single highest-value change for downstream triage.
Observed on one full-pipeline run at production scale: a private TypeScript monorepo (Angular front end, NestJS back end), 1,351 analysis units from 866 source files, run with --verify and no --limit, ~6.5 hours wall clock. The engine was invoked directly (python -m openant scan …, Python 3.13); the Go CLI was not built, so none of this involves the Go↔Python envelope. Stage 1 detection and Stage 2 verification ran on Claude Opus 5; application context, enhancement and reporting on Claude Sonnet 5 — all seven phases routed through OpenRouter (anthropic/claude-opus-5, anthropic/claude-sonnet-5) via a locally-added openrouter provider adapter, on a build based on upstream 2ed78f6. Cost figures are expressed as proportions of the run total; absolute amounts are omitted deliberately, as is the identity of the scanned repository.
Summary
Of the findings upheld by Stage 2 in our run, fewer than one in ten carried a CWE classification, an impact statement, or reproduction steps. None carried a suggested fix. There is no severity field in the output schema at all.
Evidence
Across the 82 Stage 2-upheld findings in
pipeline_output.json:descriptioncwe_id(non-zero)impactsteps_to_reproducesuggested_fixThe other 76 arrive with
cwe_id: 0,name: "vulnerable",short_name: "VULNERABLE", and prose only. The six well-formed findings are richly detailed — CWE, concrete attack path, reproduction — which suggests an extraction or schema-adherence gap rather than a design limit.Why it matters
Without severity or CWE, findings cannot be ranked, filtered, deduplicated across runs, or mapped to a remediation SLA — and 76 of 82 are mutually indistinguishable in any structured view, forcing reviewers to read prose serially.
suggested_fixexists in the schema and was populated zero times.Suggested fix
Constrain the Stage 1 and Stage 2 outputs with a schema requiring
cwe_id,severityandimpact, and treat a response missing them as a parse failure to retry rather than a finding to emit. Introducing aseverityfield at all would be the single highest-value change for downstream triage.Observed on one full-pipeline run at production scale: a private TypeScript monorepo (Angular front end, NestJS back end), 1,351 analysis units from 866 source files, run with
--verifyand no--limit, ~6.5 hours wall clock. The engine was invoked directly (python -m openant scan …, Python 3.13); the Go CLI was not built, so none of this involves the Go↔Python envelope. Stage 1 detection and Stage 2 verification ran on Claude Opus 5; application context, enhancement and reporting on Claude Sonnet 5 — all seven phases routed through OpenRouter (anthropic/claude-opus-5,anthropic/claude-sonnet-5) via a locally-addedopenrouterprovider adapter, on a build based on upstream2ed78f6. Cost figures are expressed as proportions of the run total; absolute amounts are omitted deliberately, as is the identity of the scanned repository.