From 01331ec25d90809375a086cc99367a5373b163ff Mon Sep 17 00:00:00 2001
From: cloakmaster <benshiib@gmail.com>
Date: Mon, 4 May 2026 14:10:46 +0200
Subject: [PATCH 1/2] =?UTF-8?q?data:=20scan=20corpus=20refresh=20=E2=80=94?=
 =?UTF-8?q?=202026-05-04?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add first corpus entry: ReversecLabs/damn-vulnerable-llm-agent
3 findings (0 crit, 2 high, 1 med), governance score 27/100
---
 data/scan-corpus.json | 39 ++++++++++++++++++++++++++++++++-------
 1 file changed, 32 insertions(+), 7 deletions(-)

diff --git a/data/scan-corpus.json b/data/scan-corpus.json
index c189c66..e0d45ba 100644
--- a/data/scan-corpus.json
+++ b/data/scan-corpus.json
@@ -3,12 +3,37 @@
   "_description": "Public scan corpus — the live dataset behind State of AI Agent Security 2026. Refreshed weekly by an automated routine.",
   "_methodology": "See data/scan-corpus-readme.md for methodology, included repo criteria, and rotation cadence.",
   "aggregates": {
-    "total_scans": 0,
-    "total_findings_observed": 0,
-    "average_governance_score": null,
-    "frameworks_covered": [],
-    "last_refreshed": null,
-    "first_scan_date": null
+    "total_scans": 1,
+    "total_findings_observed": 3,
+    "average_governance_score": 27.0,
+    "frameworks_covered": [
+      "sql_injection",
+      "injection",
+      "missing_audit_logging",
+      "governance"
+    ],
+    "last_refreshed": "2026-05-04T12:10:06Z",
+    "first_scan_date": "2026-05-04T12:10:06Z"
   },
-  "scans": []
+  "scans": [
+    {
+      "timestamp": "2026-05-04T12:10:06Z",
+      "repo": "ReversecLabs/damn-vulnerable-llm-agent",
+      "report_id": "c4c651c5-658b-4626-936b-882bcb37db16",
+      "findings_count": 3,
+      "critical_count": 0,
+      "high_count": 2,
+      "medium_count": 1,
+      "low_count": 0,
+      "governance_score": 27,
+      "risk_score": 22,
+      "eu_ai_act_readiness": "PARTIAL",
+      "top_finding_categories": [
+        "sql_injection",
+        "injection",
+        "missing_audit_logging",
+        "governance"
+      ]
+    }
+  ]
 }

From b9b7a5270b727e091a5f5cb4d1bf291d1873a71f Mon Sep 17 00:00:00 2001
From: Ben <ben@inkog.io>
Date: Tue, 5 May 2026 08:54:14 +0200
Subject: [PATCH 2/2] fix(corpus): rename frameworks_covered to
 finding_categories_aggregated
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The aggregate field contained finding categories (sql_injection,
missing_audit_logging, etc.) — not agent frameworks. Misleading name
would create downstream bugs when consumers expect framework values
like "LangChain", "CrewAI".

Schema corrected; values unchanged. Per the R6 prompt fix in
routines/06-scan-corpus-refresh.md, frameworks_covered is now reserved
for actual frameworks (when scan response includes agent_framework)
and aggregated finding categories live under
finding_categories_aggregated.
---
 data/scan-corpus.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/data/scan-corpus.json b/data/scan-corpus.json
index e0d45ba..10d8f0a 100644
--- a/data/scan-corpus.json
+++ b/data/scan-corpus.json
@@ -6,7 +6,7 @@
     "total_scans": 1,
     "total_findings_observed": 3,
     "average_governance_score": 27.0,
-    "frameworks_covered": [
+    "finding_categories_aggregated": [
       "sql_injection",
       "injection",
       "missing_audit_logging",