Security findings — corefile.io repository, HEAD

The first five rows mirror a live wizcli scan dir run one-to-one — same rule IDs, weakness classes, and file:line; the scan lands on exactly these five HIGH findings (WARN_BY_POLICY). The highlighted row is what today's static ruleset misses: an unauthenticated SSRF caught at runtime (DAST) and in review — the case for layered coverage.