Check every reasoning claim before filing it, and write it up for the developer

The finding page never showed a finding's description, only its title, so
a reasoning finding read as a title and nothing else.  It now shows what was
found.  Code reasoning writes each finding up for the developer: what it is,
who can reach it, how it would be exploited, the impact, how to fix it and
what to confirm.  The write-up is cached with the answer, so forks, branches
and later scans reuse it.

Every claim, not only high ones, must now survive a second look that tries to
prove it wrong.  It sees the helpers the handler calls, where the permissions
and roles it checks are granted elsewhere in the repository, and the names of
access checks it was not shown.  Only a claim it confirms is filed.  None of
that extra context is part of the cache key, so unchanged code is not asked
about again.  Check them again on the AI page gives findings filed before this
the same look: confirmed ones get the write-up, guarded and unconfirmed ones
are set aside with the reason, never closed, and nothing is checked twice.

Curated web checks gain an anonymous flag, and the 149 that say something is
exposed now send no session, so a signed in scan no longer reports a page open
only to its own account as open to anybody.  A policy test keeps new exposure
checks the same.  Two checks are added: a SCIM user directory that answers
without credentials, and an OpenAPI or Swagger description served to anyone.

Author: hackrange

app/core/code_reasoning.py

@@ -3,6 +3,7 @@
   "class": "access-control",
   "safety": "read",
   "severity_floor": "low",
+  "anonymous": true,
   "title": "Adminer sign in page is reachable from the internet",
   "summary": "Adminer is an administrative interface and its sign in page answers from the internet.  This proves it is exposed, not that it can be used without a password.",
   "needs": [],

app/core/dast_checks/curated/access-control-adminer-open.json

@@ -3,6 +3,7 @@
   "class": "access-control",
   "safety": "read",
   "severity_floor": "high",
+  "anonymous": true,
   "title": "Apache Airflow is reachable without signing in",
   "summary": "The Airflow API answers unauthenticated, which exposes the pipelines and can run or change them.",
   "needs": [],

app/core/dast_checks/curated/access-control-airflow-open.json

@@ -3,6 +3,7 @@
   "class": "access-control",
   "safety": "read",
   "severity_floor": "medium",
+  "anonymous": true,
   "title": "An Argo CD API answers unauthenticated",
   "summary": "The Argo CD API returns its version without a sign in, which usually means the GitOps controller is exposed.",
   "needs": [],

app/core/dast_checks/curated/access-control-argocd-open.json

@@ -3,6 +3,7 @@
   "class": "access-control",
   "safety": "read",
   "severity_floor": "low",
+  "anonymous": true,
   "title": "The ColdFusion Administrator sign in page is reachable from the internet",
   "summary": "The ColdFusion Administrator is an administrative interface and its sign in page answers from the internet.  This proves it is exposed, not that it can be used without a password. It has a long history of authentication bypass and remote code execution, so keeping it off the internet matters more than usual.",
   "needs": [],

app/core/dast_checks/curated/access-control-coldfusion-admin-exposed.json

@@ -3,6 +3,7 @@
   "class": "access-control",
   "safety": "read",
   "severity_floor": "high",
+  "anonymous": true,
   "title": "HashiCorp Consul is reachable without signing in",
   "summary": "The Consul agent API answers unauthenticated, which exposes the service catalog and the key value store and can change them.",
   "needs": [],

app/core/dast_checks/curated/access-control-consul-open.json

@@ -3,6 +3,7 @@
   "class": "access-control",
   "safety": "read",
   "severity_floor": "high",
+  "anonymous": true,
   "title": "CouchDB is reachable without signing in",
   "summary": "The CouchDB HTTP API answers unauthenticated at the root, a direct path to the stored data.",
   "needs": [],

app/core/dast_checks/curated/access-control-couchdb-open.json

@@ -3,6 +3,7 @@
   "class": "access-control",
   "safety": "read",
   "severity_floor": "critical",
+  "anonymous": true,
   "title": "The Docker engine API is reachable",
   "summary": "The Docker remote API answers unauthenticated, which is control of the host: an attacker can start a container that mounts the disk.",
   "needs": [],

app/core/dast_checks/curated/access-control-docker-api-open.json

@@ -3,6 +3,7 @@
   "class": "access-control",
   "safety": "read",
   "severity_floor": "high",
+  "anonymous": true,
   "title": "A Docker registry is reachable without signing in",
   "summary": "The Docker registry v2 API answers unauthenticated, which lets an attacker list, pull and push the container images.",
   "needs": [],

app/core/dast_checks/curated/access-control-docker-registry-open.json

@@ -3,6 +3,7 @@
   "class": "access-control",
   "safety": "read",
   "severity_floor": "medium",
+  "anonymous": true,
   "title": "An Apache Druid console is exposed",
   "summary": "The Apache Druid console answers here without signing in, which lets its data and queries be reached.",
   "needs": [],