Remediate CodeQL alerts #101–#125 via log redaction, SSH trust hardening, and SCIM parser fix

[Copilot]

Addressed the requested code scanning alerts across security skill scripts with minimal, targeted changes. True positives were fixed in-place; alerts assessed as false positives were left unchanged and documented.

• Sensitive data logging: remove/limit high-risk console output

  • Replaced full report dumps with safe summaries in API/JWT/OpenCTI/DCSync flows.
  • Redacted secret values in Gitleaks output paths.
  • Removed stderr fragments from AD/BloodHound command-failure logs to avoid credential/hash leakage.

• SSH host key validation: enforce trust-on-known-hosts

  • Replaced permissive Paramiko host-key behavior in rsyslog deployment and vuln-scan scripts.
  • Moved to system host keys + reject-unknown policy.

• SCIM filter parsing: remove ReDoS-prone regex path

  • Replaced regex-based parse_scim_filter with bounded deterministic parsing (split + structural validation).

• False positives (no code changes)

  • Alerts: #101, #102, #103, #104, #105, #109, #110, #111, #113, #114, #115.

client = paramiko.SSHClient()
client.load_system_host_keys()
client.set_missing_host_key_policy(paramiko.RejectPolicy())