Audit History
java-springboot - 5 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v5 Latest | Jul 23, 2026, 06:04 PM | No confirmed findings | 0 | No capability change |
| v4 | Jul 8, 2026, 01:56 AM | No confirmed findings | 0 | No capability change |
| v3 | Jul 6, 2026, 03:48 PM | No confirmed findings | 0 | External commands |
| v2 | Jun 30, 2026, 02:34 AM | No confirmed findings | 0 | No capability change |
| v1 | Apr 4, 2026, 08:20 AM | No confirmed findings | 0 | Baseline |
Jul 23, 2026, 06:04 PM
All 18 static findings are false positives caused by Markdown inline-code backticks around Spring Boot names and Java examples. SKILL.md contains guidance only, with no shell execution, prompt injection, data exfiltration, or other semantic security concern.
Risk Factors
Jul 8, 2026, 01:56 AM
All 18 static external-command findings are false positives caused by Markdown inline-code backticks in SKILL.md. I found no shell execution instructions, prompt injection text, network access, credential collection, or unsafe install behavior in the reviewed file.
Risk Factors
Jul 6, 2026, 03:48 PM
All 18 static findings are false positives caused by Markdown inline-code backticks in SKILL.md. The skill contains Spring Boot best-practice guidance only; no shell execution, prompt injection, or data exfiltration intent was found.
Risk Factors
Jun 30, 2026, 02:34 AM
Static analysis reported external command execution and weak cryptography patterns, but review found these are false positives from Markdown inline code and ordinary Spring Boot guidance. No executable scripts, network calls, secret access, prompt injection text, or malicious behavior were found in the reviewed file.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Apr 4, 2026, 08:20 AM
All 36 static findings are false positives. The external_commands detections are markdown backtick formatting for code references (e.g., pom.xml, @Service). The weak_crypto detections incorrectly flagged 'RESTful' and 'description' as cryptographic issues. This is a legitimate Spring Boot best practices document containing no security vulnerabilities or malicious code.