[yashaskn8]

Verified source-path security risk

PR #5's backend/app/reporting/sarif.py::_safe_path rejects traversal, absolute paths and controls but does not apply the repository's contains_secrets detector to evidence paths. The SARIF builder then writes the URI returned by _safe_path into artifactLocation.uri. A canonically attested repository filename containing a recognizable token pattern (for example a synthetic ghp_-shaped filename) can therefore be serialized into the downloadable SARIF artifact. The existing is_canonical_confirmed_finding attestation check verifies provenance, not secret-free filenames. This is a confirmed code-path risk; no actual credential exposure has been observed.

Minimal change

• Reuse app.security.redaction.contains_secrets in _safe_path to omit a finding with a credential-shaped evidence path rather than output a redacted/invalid URI.
• Add an API-level regression test with synthetic GitHub-token and API-key-shaped filenames. Existing tests already cover a normal repository-relative path.

Validation / review required

• Source, existing CI logs, and the branch diff were inspected through GitHub. The new regression test has not been executed, and no repository code was run locally.
• PR feat: verified SARIF export for completed scans #5's latest Actions run 41196979005 passed backend and Windows checks; its 14 frontend failures match those on PR feat: verified SARIF export with hourly regression checks and annual feature review #7's earlier run 41184542239 and are not newly attributed to this change.
• Run focused backend tests and full CI, then require independent human security review before considering merge. This draft targets PR feat: verified SARIF export for completed scans #5's feature branch, not main. Do not auto-merge or deploy.