java-topology/SCAN-TODO.md

Scan TODO — Unscanned High-Value Targets

Status: 865 UNDF, 420+ defect dirs, 34 waves complete. Rule: clone, scan, delete clone after. Keep disk under 90%.

Priority 1 — Major infrastructure not yet scanned

• Squid (C, HTTP proxy, huge install base)
• Sendmail (C, MTA) — sendmail-0001 MOAD-0004 CWE-312 SASL client password logged verbatim at tTd(95,5) debug level in getauth(); MOADs 0001/0002/0003/0005 CLEAN
• PgBouncer (C, PostgreSQL connection pooler) — pgbouncer-0001 MOAD-0004 CWE-312 SCRAM verifier logged at slog_debug; pgbouncer-0002 MOAD-0001 CWE-407 find_database() O(D) linear scan per connection 100x at D=100; MOADs 0002/0003/0005 CLEAN (single-threaded libevent)
• Suricata (C, IDS/IPS) — suricata-0001 (CWE-407 threshold SID lookup O(T×S), CWE-312 auth header logging); suricata-0002 (CWE-407 EveHttpLogJSONHeaders O(H×F=53) per tx, 53x); MOADs 0003/0005 CLEAN
• ClamAV (C, antivirus engine) — clamav-0001 MOAD-0004 CWE-312 proxy password logged verbatim on curl failure; MOAD-0001/0002/0003/0005 CLEAN (AC trie, BM hash, mutex-protected cache)
• Snort (C++, IDS/IPS) — snort3-0001 MOAD-0001 CWE-407 service_candidates std::find dedup O(MC) per packet in AppID ServiceDiscovery 72x at M=10000; snort3-0002 MOAD-0001 CWE-407 CHP match_tally std::find_if O(MT) per HTTP packet 48x at T=100; MOADs 0002/0003/0004/0005 CLEAN
• WireGuard (deeper, Go userspace tools)
• Thunderbird (C++, email client, undo/history)
• Wine (C, Windows compatibility layer)

Priority 2 — ERP/Business not yet scanned

• Dolibarr (PHP, ERP) — scanned (see prior wave)
• Tryton (Python, ERP) — tryton-0001 (_save_values previous list O(T*P)); MOADs 0002/0003/0004/0005 CLEAN
• xTuple PostBooks (C++/JS, ERP)
• SuiteCRM (PHP, CRM)
• InvoiceNinja (PHP, invoicing)

Priority 3 — Collaboration/Chat

• Rocket.Chat (deeper, TypeScript) — 0003 MOAD-0001 video-conf endDirectCall O(S*U); 0004 MOAD-0004 CWE-312 OAuth secrets logged; MOAD-0002/0003/0005 CLEAN
• Zulip (deeper, Python)
• Jitsi Meet (Java/TypeScript)
• Matrix Dendrite (Go, alt homeserver — already in defects/)
• Mattermost (deeper, Go)

Priority 4 — Desktop apps

• Pidgin/Finch (C, chat client)
• HexChat (C, IRC client)
• Evolution (C, email/calendar)
• Thunderbird (C++, email)
• Calibre (deeper, Python ebook manager)
• Okular/Evince/Zathura (PDF viewers)
• OpenSCAD (C++, parametric CAD)
• Solvespace (C++, parametric CAD)
• Cura / PrusaSlicer (C++, 3D printing slicers)

Priority 5 — AI/ML new wave

• Ollama (Go, local LLM runtime)
• LangChain (Python, LLM orchestration)
• Hugging Face Transformers (Python)
• vLLM (Python/C++, LLM serving)
• llama.cpp (C++, already deleted clone, re-clone to scan)

Priority 6 — Scientific/Data

• OpenFOAM (C++, CFD simulation)
• ROOT (C++, CERN data analysis)
• Scilab (C/Fortran, numerical computation)
• Octave (deeper, C++)
• R (deeper, C)
• Julia (deeper)

Priority 7 — Emulators/Retro

• PCSX2 (C++, PS2 emulator)
• RPCS3 (C++, PS3 emulator)
• PPSSPP (C++, PSP emulator)
• DOSBox-X (C++, DOS emulator)

Priority 8 — Networking/Infra

• Spamhaus tooling: rbldnsd (C, DNS blocklist server) CLEAN all 5 MOADs; dnsdbq (C, pDNS CLI) dnsdbq-0001 MOAD-0004 CWE-312 API key logged verbatim in debug mode; pdns-logger CLEAN; rdap (Go library) CLEAN
• Forgejo (Go, Gitea fork)
• Woodpecker CI (Go)
• Drone CI (Go)
• Gitea (deeper)
• Wekan (Meteor/JS, kanban board) — wekan-0003 MOAD-0001 wekanCreator member dedup O(M^2)/O(C*M^2); MOAD-0002/0003/0004/0005 CLEAN
• Taiga (Python, project management)
• Redmine (Ruby, project management)

Priority 9 — IoT/Embedded

• Zephyr RTOS (C)
• FreeRTOS (C)
• Contiki-NG (C)
• ESP-IDF (C)
• TinyGo (Go)

Already scanned CLEAN (no need to rescan)

Odoo, Beam, Krita, Hive (pre-existing only), Keycloak, Shiro, Netdata, etcd, GCC, Rust compiler, ScyllaDB, qBittorrent, Transmission, pygame, MPD, Rhythmbox, MAME, Dolphin, ScummVM, Nextcloud, Gitea, mpv, Metabase, Emacs, HandBrake, Kubernetes (MOAD-5)