{
  "repository": "https://github.com/zaproxy/zap-extensions",
  "commit_source": "git_worktree_rev_parse",
  "commit_sha": "ac6c3f94d38505bc0facea286a4d3728044c6e5c",
  "submitted_target": {
    "target_kind": "git_commit_parent_of_fix",
    "commit_sha": "7e686c0900e82bb73b57880c0328d012269f8741",
    "version": "viewstate_before_4",
    "ref": "ac6c3f94d38505bc0facea286a4d3728044c6e5c^",
    "display": "ZAP ViewState add-on before version 4; tested fixed-parent commit 7e686c0900e82bb73b57880c0328d012269f8741"
  },
  "variant_target": {
    "target_kind": "git_commit_fixed_negative_control",
    "commit_sha": "ac6c3f94d38505bc0facea286a4d3728044c6e5c",
    "version": "viewstate_v4",
    "ref": "ac6c3f94d38505bc0facea286a4d3728044c6e5c",
    "display": "ZAP ViewState add-on version 4 fix commit; request-panel variant blocked"
  },
  "additional_tested_sources": [
    {
      "target_kind": "git_commit_vulnerable_variant_positive_control",
      "commit_sha": "7e686c0900e82bb73b57880c0328d012269f8741",
      "display": "Vulnerable fixed-parent commit where request-panel alternate trigger was confirmed"
    },
    {
      "target_kind": "git_commit_latest_inspected",
      "commit_sha": "c639b4e3fe10e472cbe8542de7fbe3964b4d4ce7",
      "display": "Default cached repository head inspected for JSF registration; registration remained commented out"
    }
  ],
  "built_artifacts": {
    "vulnerable_zap_sha256": "bc54a65461982b7751d19455064d7dc45b12bda60d2c6b6c2c8a664a56e43f27",
    "fixed_zap_sha256": "ce7bb28416a7e3e2b75aa24199c16c362a019cf50915cad3f686724ae14463bd"
  },
  "notes": "A distinct alternate trigger was confirmed on the vulnerable commit, but not on the fixed commit. Source identity is recorded to preserve the exact fixed negative-control target and vulnerable positive-control target."
}