Synvoya · Synvoya · Jul 17, 2026 · Jul 17, 2026
diff --git a/README.md b/README.md
@@ -6,6 +6,7 @@
 ![Local-first](https://img.shields.io/badge/local--first-yes-brightgreen.svg)
 ![No telemetry](https://img.shields.io/badge/telemetry-none-brightgreen.svg)
 [![codeinspectus MCP server](https://glama.ai/mcp/servers/Synvoya/codeinspectus/badges/score.svg)](https://glama.ai/mcp/servers/Synvoya/codeinspectus)
+[![GitHub stars](https://img.shields.io/github/stars/Synvoya/codeinspectus?style=social)](https://github.com/Synvoya/codeinspectus)
 
 **A local-first, privacy-preserving security MCP server.** Any AI coding agent
 (Claude Code, Cursor, Codex, Windsurf, Cline, Aider) can invoke CodeInspectus to
@@ -16,6 +17,16 @@ egress at scan time**.
 
 ![CodeInspectus demo](assets/codeinspectus-demo.gif)
 
+**Reproduce the proof:** the shipped intentionally vulnerable fixture produces
+**18 normalized findings across all four engines** with v0.3.1 (4 critical, 8 high,
+5 medium, 1 low). Inspect the [fixture](fixtures/vulnerable-app), read the
+[full scanner-derived report](examples/reports/vulnerable-app-v0.3.1.md), or run the
+[17-case eval suite](evals/run-evals.ts). Dependency findings can change as the local
+Trivy database updates; the report records the exact engine and database versions used.
+
+If CodeInspectus is useful, [star the repository](https://github.com/Synvoya/codeinspectus)
+so other AI-app builders can find it.
+
 CodeInspectus orchestrates three best-in-class OSS engines behind one normalized,
 CWE-keyed schema, and adds its own **AI-code-specific checks** that generic
 scanners miss:
@@ -223,9 +234,7 @@ ALL LOCAL. NO NETWORK EGRESS AT SCAN TIME.
 
 ## Example reports
 
-- [Next.js + Supabase SaaS app](examples/reports/nextjs-supabase.md)
-- [AI chatbot / RAG app](examples/reports/ai-chatbot-rag.md)
-- [Node/React app](examples/reports/node-react.md)
+- [Reproducible v0.3.1 scan of the shipped vulnerable fixture](examples/reports/vulnerable-app-v0.3.1.md)
 
 ## Trademark
 
@@ -282,15 +291,13 @@ practitioner)*
 
 ## Good first contributions
 
-- Add a fixture for the unsafe raw inner-HTML sink (`ci-ai-llm-output-dangerous-html`) from component props.
-- Improve detection for Supabase `user_metadata.role` authorization checks.
-- Add detection for exposed `NEXT_PUBLIC_OPENAI_API_KEY` and similar client-side AI keys.
-- Add a rule for user-controlled URLs passed into server-side `fetch()`.
-- Add a rule for model output passed into `eval`, `Function`, shell commands, or unsafe tool calls.
-- Add a check for missing auth guards in Next.js `/api/admin/*` routes.
-- Verify one CWE to OWASP Top 10 mapping.
-- Verify one CWE to SOC 2 / ISO 27001 mapping.
-- Add a vulnerable fixture and expected finding snapshot for an existing rule.
+- [Trace tainted component props into `dangerouslySetInnerHTML`](https://github.com/Synvoya/codeinspectus/issues/1)
+- [Detect model output passed to dynamic execution or shell sinks](https://github.com/Synvoya/codeinspectus/issues/2)
+- [Detect unguarded Next.js admin API routes](https://github.com/Synvoya/codeinspectus/issues/3)
+- [Community-verify one CWE to OWASP Top 10 mapping](https://github.com/Synvoya/codeinspectus/issues/4)
+- [Community-verify one CWE to SOC 2 or ISO 27001](https://github.com/Synvoya/codeinspectus/issues/5)
+
+[Browse all good first issues](https://github.com/Synvoya/codeinspectus/issues?q=is%3Aissue%20state%3Aopen%20label%3A%22good%20first%20issue%22).
 
 ## Changelog
 

diff --git a/examples/reports/ai-chatbot-rag.md b/examples/reports/ai-chatbot-rag.md
diff --git a/examples/reports/nextjs-supabase.md b/examples/reports/nextjs-supabase.md
diff --git a/examples/reports/node-react.md b/examples/reports/node-react.md
diff --git a/examples/reports/vulnerable-app-v0.3.1.md b/examples/reports/vulnerable-app-v0.3.1.md
@@ -0,0 +1,63 @@
+# Reproducible v0.3.1 fixture scan
+
+This is a scanner-derived report from CodeInspectus v0.3.1 running against the
+repository's intentionally vulnerable [`fixtures/vulnerable-app`](../../fixtures/vulnerable-app)
+on 17 July 2026. It replaces illustrative reports whose findings could not be
+reproduced from a committed fixture.
+
+## Reproduce it
+
+```bash
+npm install
+npm run build
+npx tsx scripts/dev-scan.ts fixtures/vulnerable-app
+```
+
+The engine binaries must already be installed and verified. See the main README for
+`install-engines` and `verify-engines`.
+
+## Recorded environment
+
+| Component | Version or value |
+| --- | --- |
+| CodeInspectus package | 0.3.1 |
+| Opengrep | 1.23.0 |
+| Gitleaks | 8.30.1 |
+| Trivy | 0.71.2 |
+| CodeInspectus AI checks | 1.0.0 |
+| Trivy database | 2026-07-15T23:36:30.755301Z |
+
+## Result
+
+CodeInspectus normalized 21 raw engine results into 18 findings: **4 critical,
+8 high, 5 medium, and 1 low**. The lower normalized count is expected because the
+same hard-coded client secret was detected by Gitleaks, Trivy, and the CodeInspectus
+AI checks, then deduplicated into one finding with all three engines retained as evidence.
+
+| Severity | Rule | Location | Engine evidence |
+| --- | --- | --- | --- |
+| Critical | `CVE-2019-10744` | `package-lock.json:15` | Trivy |
+| Critical | `CVE-2021-44906` | `package-lock.json:20` | Trivy |
+| Critical | `ci-ai-client-hardcoded-secret` | `src/config.ts:5` | Gitleaks + Trivy + CodeInspectus AI |
+| Critical | `ci-ai-rls-using-true` | `supabase/migrations/0001_init.sql:18` | CodeInspectus AI |
+| High | `CVE-2018-16487` | `package-lock.json:15` | Trivy |
+| High | `CVE-2020-8203` | `package-lock.json:15` | Trivy |
+| High | `CVE-2021-23337` | `package-lock.json:15` | Trivy |
+| High | `CVE-2026-4800` | `package-lock.json:15` | Trivy |
+| High | `ci-ai-public-env-secret` | `src/components/PaymentForm.tsx:6` | CodeInspectus AI |
+| High | `ci-baseline-sql-injection-string-build` | `src/db.ts:11` | Opengrep |
+| High | `ci-ai-prompt-injection-sink` | `src/llm.ts:11` | CodeInspectus AI |
+| High | `ci-ai-rls-missing` | `supabase/migrations/0001_init.sql:22` | CodeInspectus AI |
+| Medium | `CVE-2019-1010266` | `package-lock.json:15` | Trivy |
+| Medium | `CVE-2020-28500` | `package-lock.json:15` | Trivy |
+| Medium | `CVE-2025-13465` | `package-lock.json:15` | Trivy |
+| Medium | `CVE-2026-2950` | `package-lock.json:15` | Trivy |
+| Medium | `CVE-2020-7598` | `package-lock.json:20` | Trivy |
+| Low | `CVE-2018-3721` | `package-lock.json:15` | Trivy |
+
+## What is stable and what can drift
+
+The committed fixture, CodeInspectus rule IDs, file locations, and engine versions above
+make this run auditable. CVE findings are database-dependent: a newer local Trivy database
+may add, remove, or reclassify dependency findings. That is expected and should not be
+hidden behind a permanently frozen marketing number.