diff --git a/scripts/aidlc-traceability/docs/threat-model.md b/scripts/aidlc-traceability/docs/threat-model.md
index a4c66fc6e..b613bed4c 100644
--- a/scripts/aidlc-traceability/docs/threat-model.md
+++ b/scripts/aidlc-traceability/docs/threat-model.md
@@ -180,20 +180,21 @@ No external network calls. All data stays local.
 
 ## Threat & Mitigation Detail
 
-| Threat # | Priority | Threat                                                                                                                          | STRIDE                 | Affected Assets         | Mitigations  | Decision | Status                       |
-| -------- | -------- | ------------------------------------------------------------------------------------------------------------------------------- | ---------------------- | ----------------------- | ------------ | -------- | ---------------------------- |
-| T-001    | High     | TA1 injects malicious content into artifact markdown files to produce a misleading traceability report                          | Tampering              | Artifact files, Reports | M-001, M-002 | Mitigate | Mitigated                    |
-| T-002    | High     | TA1 places `<script>` tags or event handlers in artifact titles/descriptions, causing XSS when HTML report is opened in browser | Tampering              | HTML reports            | M-003        | Mitigate | Mitigated                    |
-| T-003    | High     | TA4 (AI model) hallucinate artifact IDs, inserting false relationships into the traceability graph                              | Tampering              | Graph, Reports          | M-004        | Mitigate | Mitigated                    |
-| T-004    | High     | TA2 or TA3 intercepts AWS credentials used for Amazon Bedrock calls                                                             | Information Disclosure | AWS credentials         | M-005, M-006 | Mitigate | Mitigated                    |
-| T-005    | High     | TA3 performs MITM attack to intercept source code sent to Amazon Bedrock                                                        | Information Disclosure | Source code             | M-006        | Mitigate | Mitigated                    |
-| T-006    | Medium   | TA5 reads generated reports containing artifact summaries and source file paths                                                 | Information Disclosure | Reports                 | M-007        | Mitigate | User responsibility          |
-| T-007    | Medium   | TA2 modifies generated report after creation to misrepresent compliance status                                                  | Tampering              | Reports                 | M-008        | Mitigate | User responsibility          |
-| T-008    | Medium   | TA1 creates extremely large artifact files or thousands of files to exhaust memory                                              | Denial of Service      | Tool availability       | M-009        | Accept   | Accepted (local impact only) |
-| T-009    | Medium   | TA4 (AI model) injects prompt injection payload via crafted artifact content                                                    | Tampering              | AI analysis             | M-004, M-010 | Mitigate | Mitigated                    |
-| T-010    | Low      | TA2 replaces the `traceability` binary with a malicious executable via PATH manipulation                                        | Elevation of Privilege | User workstation        | M-011        | Accept   | User responsibility          |
-| T-011    | Low      | TA1 creates symlinks in project directory pointing to sensitive files outside project                                           | Information Disclosure | Filesystem              | M-012        | Mitigate | Mitigated                    |
-| T-012    | Medium   | Sensitive source code is sent to Amazon Bedrock during AI analysis without user awareness                                       | Information Disclosure | Source code             | M-013        | Mitigate | Mitigated                    |
+| Threat # | Priority | Threat                                                                                                                                               | STRIDE                 | Affected Assets         | Mitigations  | Decision | Status                       |
+| -------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------- | ----------------------- | ------------ | -------- | ---------------------------- |
+| T-001    | High     | TA1 injects malicious content into artifact markdown files to produce a misleading traceability report                                               | Tampering              | Artifact files, Reports | M-001, M-002 | Mitigate | Mitigated                    |
+| T-002    | High     | TA1 places `<script>` tags or event handlers in artifact titles/descriptions, causing XSS when HTML report is opened in browser                      | Tampering              | HTML reports            | M-003        | Mitigate | Mitigated                    |
+| T-003    | High     | TA4 (AI model) hallucinate artifact IDs, inserting false relationships into the traceability graph                                                   | Tampering              | Graph, Reports          | M-004        | Mitigate | Mitigated                    |
+| T-004    | High     | TA2 or TA3 intercepts AWS credentials used for Amazon Bedrock calls                                                                                  | Information Disclosure | AWS credentials         | M-005, M-006 | Mitigate | Mitigated                    |
+| T-005    | High     | TA3 performs MITM attack to intercept source code sent to Amazon Bedrock                                                                             | Information Disclosure | Source code             | M-006        | Mitigate | Mitigated                    |
+| T-006    | Medium   | TA5 reads generated reports containing artifact summaries and source file paths                                                                      | Information Disclosure | Reports                 | M-007        | Mitigate | User responsibility          |
+| T-007    | Medium   | TA2 modifies generated report after creation to misrepresent compliance status                                                                       | Tampering              | Reports                 | M-008        | Mitigate | User responsibility          |
+| T-008    | Medium   | TA1 creates extremely large artifact files or thousands of files to exhaust memory                                                                   | Denial of Service      | Tool availability       | M-009        | Accept   | Accepted (local impact only) |
+| T-009    | Medium   | TA4 (AI model) injects prompt injection payload via crafted artifact content                                                                         | Tampering              | AI analysis             | M-004, M-010 | Mitigate | Mitigated                    |
+| T-010    | Low      | TA2 replaces the `traceability` binary with a malicious executable via PATH manipulation                                                             | Elevation of Privilege | User workstation        | M-011        | Accept   | User responsibility          |
+| T-011    | Low      | TA1 creates symlinks in project directory pointing to sensitive files outside project                                                                | Information Disclosure | Filesystem              | M-012        | Mitigate | Mitigated                    |
+| T-012    | Medium   | Sensitive source code is sent to Amazon Bedrock during AI analysis without user awareness                                                            | Information Disclosure | Source code             | M-013        | Mitigate | Mitigated                    |
+| T-013    | Medium   | TA1/TA4 uses prompt injection in artifact content to direct the Component→Code agent's file-reading tool to read host files outside the project root | Information Disclosure | Filesystem, Source code | M-014        | Mitigate | Mitigated                    |
 
 ## APPENDIX A - APIs
 
@@ -205,18 +206,19 @@ No external network calls. All data stays local.
 
 ## APPENDIX B - Mitigations
 
-| Mitigation # | Mitigation Description                                                                                                                                                                                                | Threats Mitigating | Status               | Comments                                                   |
-| ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------ | -------------------- | ---------------------------------------------------------- |
-| M-001        | Parsers use compiled regex patterns for extraction; no `eval()`, `exec()`, or dynamic code execution. Pydantic validates all artifact models.                                                                         | T-001              | Complete             | `parsers/requirements.py:26`, `models.py:23`               |
-| M-002        | Pipeline continues on parser errors, logging warnings. One malformed file does not affect others. Reports include generation timestamp for audit trail.                                                               | T-001, T-007       | Complete             | `pipeline.py:88-94`                                        |
-| M-003        | All user-supplied content in HTML reports is escaped via `html.escape()` (Python-side) and `escapeHtml()` (JavaScript-side). No external resources loaded.                                                            | T-002              | Complete             | `generators/html.py:116-117`, `generators/html.py:514-527` |
-| M-004        | All AI-discovered relationships are validated against the set of known parsed artifact IDs. Relationships referencing non-existent IDs are silently discarded. Count of discarded relationships is logged.            | T-003, T-009       | Complete             | `agent.py:189-228`                                         |
-| M-005        | Tool uses boto3 standard credential chain (env vars → profile → IAM role). Credentials are not hardcoded, stored, logged, or included in reports. Error messages do not expose credential details.                    | T-004              | Complete             | `agent.py:23-35`, verified by Bandit scan                  |
-| M-006        | All Amazon Bedrock API calls use HTTPS with TLS 1.2+ enforced by boto3/botocore with certificate validation enabled by default.                                                                                       | T-004, T-005       | Complete             | boto3 default behavior                                     |
-| M-007        | Report files are written with the user's default umask. Users should set restrictive permissions (`chmod 600`) and store reports in access-controlled storage.                                                        | T-006              | User action required | Documented in `docs/security-design.md`                    |
-| M-008        | Reports include generation timestamp. Reports can be regenerated from source artifacts. Users should store reports in version control or integrity-verified storage.                                                  | T-007              | User action required | Documented in `docs/shared-responsibility.md`              |
-| M-009        | Pipeline uses per-file error handling. Code parser reads with `errors="ignore"`. AI agent limits source reading to 30 files, 200 lines each. NetworkX operations are bounded by artifact count.                       | T-008              | Complete             | `pipeline.py:88-94`, `agent.py:50-65`                      |
-| M-010        | Each AI agent has a focused system prompt limiting its scope to specific artifact pairs. Agents can only add relationships; they cannot remove valid ones. Non-JSON responses are discarded entirely.                 | T-009              | Complete             | `agent.py:86-170`                                          |
-| M-011        | Tool is installed via `uv sync` with pinned dependencies in `uv.lock`. Users should verify installation source.                                                                                                       | T-010              | User action required | Standard Python packaging                                  |
-| M-012        | File discovery is bounded to `src/`, `lib/`, `app/`, `packages/` under project root. Excluded directories include `.git`, `venv`, `node_modules`. Tool operates read-only on discovered files.                        | T-011              | Complete             | `discovery.py:83-88, 98-109`                               |
-| M-013        | AI analysis is optional (`--no-ai` flag). Data sent to Amazon Bedrock is documented in `docs/bedrock-security.md`. Amazon Bedrock does not retain customer data or use it for model training (per AWS Service Terms). | T-012              | Complete             | `cli.py:26`, `docs/bedrock-security.md`                    |
+| Mitigation # | Mitigation Description                                                                                                                                                                                                                                                                                                                                                                                                | Threats Mitigating | Status               | Comments                                                                             |
+| ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------ | -------------------- | ------------------------------------------------------------------------------------ |
+| M-001        | Parsers use compiled regex patterns for extraction; no `eval()`, `exec()`, or dynamic code execution. Pydantic validates all artifact models.                                                                                                                                                                                                                                                                         | T-001              | Complete             | `parsers/requirements.py:26`, `models.py:23`                                         |
+| M-002        | Pipeline continues on parser errors, logging warnings. One malformed file does not affect others. Reports include generation timestamp for audit trail.                                                                                                                                                                                                                                                               | T-001, T-007       | Complete             | `pipeline.py:88-94`                                                                  |
+| M-003        | All user-supplied content in HTML reports is escaped: sidebar rendering uses `html.escape()` (Python-side), client-side rendering uses `escapeHtml()` (JavaScript-side), and the embedded artifact-data JSON block neutralizes `</` → `<\/` so a crafted title/description cannot break out of the `<script>` context. No external resources loaded.                                                                  | T-002              | Complete             | `generators/html.py:116-117`, `generators/html.py:382`, `generators/html.py:514-527` |
+| M-004        | All AI-discovered relationships are validated against the set of known parsed artifact IDs. Relationships referencing non-existent IDs are silently discarded. Count of discarded relationships is logged.                                                                                                                                                                                                            | T-003, T-009       | Complete             | `agent.py:232-271`                                                                   |
+| M-005        | Tool uses boto3 standard credential chain (env vars → profile → IAM role). Credentials are not hardcoded, stored, logged, or included in reports. Error messages do not expose credential details.                                                                                                                                                                                                                    | T-004              | Complete             | `agent.py:23-35`, verified by Bandit scan                                            |
+| M-006        | All Amazon Bedrock API calls use HTTPS with TLS 1.2+ enforced by boto3/botocore with certificate validation enabled by default.                                                                                                                                                                                                                                                                                       | T-004, T-005       | Complete             | boto3 default behavior                                                               |
+| M-007        | Report files are written with the user's default umask. Users should set restrictive permissions (`chmod 600`) and store reports in access-controlled storage.                                                                                                                                                                                                                                                        | T-006              | User action required | Documented in `docs/security-design.md`                                              |
+| M-008        | Reports include generation timestamp. Reports can be regenerated from source artifacts. Users should store reports in version control or integrity-verified storage.                                                                                                                                                                                                                                                  | T-007              | User action required | Documented in `docs/shared-responsibility.md`                                        |
+| M-009        | Pipeline uses per-file error handling. Code parser reads with `errors="ignore"`. AI agent limits source reading to 30 files, 200 lines each. NetworkX operations are bounded by artifact count.                                                                                                                                                                                                                       | T-008              | Complete             | `pipeline.py:88-94`, `agent.py:93-116`                                               |
+| M-010        | Each AI agent has a focused system prompt limiting its scope to specific artifact pairs. Agents can only add relationships; they cannot remove valid ones. Non-JSON responses are discarded entirely.                                                                                                                                                                                                                 | T-009              | Complete             | `agent.py:86-170`                                                                    |
+| M-011        | Tool is installed via `uv sync` with pinned dependencies in `uv.lock`. Users should verify installation source.                                                                                                                                                                                                                                                                                                       | T-010              | User action required | Standard Python packaging                                                            |
+| M-012        | File discovery is bounded to `src/`, `lib/`, `app/`, `packages/` under project root. Excluded directories include `.git`, `venv`, `node_modules`. Symlinks are skipped (`is_symlink()`) and each discovered file's resolved path is verified to remain within the project root, so a symlink pointing outside the project is neither followed nor read. Tool operates read-only on discovered files.                  | T-011              | Complete             | `discovery.py:83-88`, `discovery.py:98-135`                                          |
+| M-013        | AI analysis is optional (`--no-ai` flag). Data sent to Amazon Bedrock is documented in `docs/bedrock-security.md`. Amazon Bedrock does not retain customer data or use it for model training (per AWS Service Terms).                                                                                                                                                                                                 | T-012              | Complete             | `cli.py:26`, `docs/bedrock-security.md`                                              |
+| M-014        | The Component→Code agent's `read_source_code_file` tool is created by a factory (`make_source_code_reader`) that binds the project root in a closure. Every requested path is resolved and rejected if it falls outside the project boundary (traversal, absolute path, or symlink escape), so prompt injection cannot read arbitrary host files. Mirrors the sibling `_resolve_safe()` pattern in `aidlc-evaluator`. | T-013              | Complete             | `agent.py:66-117`, `agent.py:193-224`                                                |
diff --git a/scripts/aidlc-traceability/src/traceability/agent.py b/scripts/aidlc-traceability/src/traceability/agent.py
index 43218400d..7ace5e385 100644
--- a/scripts/aidlc-traceability/src/traceability/agent.py
+++ b/scripts/aidlc-traceability/src/traceability/agent.py
@@ -62,25 +62,59 @@ def list_artifact_files(directory: str) -> str:
     return json.dumps(files, indent=2)
 
 
-@tool
-def read_source_code_file(file_path: str, max_lines: int = 200) -> str:
-    """Read the contents of a source code file.
+def _resolve_within_project(project_root: Path, file_path: str) -> Path:
+    """Resolve a source path within the project root, preventing traversal.
 
-    Args:
-        file_path: Path to the source code file to read.
-        max_lines: Maximum number of lines to return (default 200).
+    Accepts absolute paths or paths relative to the project root. Strips an
+    optional "CODE:" artifact-ID prefix. Rejects any path (including symlink
+    targets) that resolves outside the project boundary.
     """
-    p = Path(file_path)
-    if not p.exists():
-        return f"Error: File not found: {file_path}"
-    try:
-        content = p.read_text(encoding="utf-8", errors="ignore")
-        lines = content.split("\n")
-        if len(lines) > max_lines:
-            return "\n".join(lines[:max_lines]) + f"\n\n... ({len(lines) - max_lines} more lines truncated)"
-        return content
-    except Exception as e:
-        return f"Error reading file: {e}"
+    root = project_root.resolve()
+    raw = file_path[len("CODE:"):] if file_path.startswith("CODE:") else file_path
+    candidate = Path(raw)
+    combined = candidate if candidate.is_absolute() else (root / candidate)
+    resolved = combined.resolve()
+    if resolved != root and root not in resolved.parents:
+        raise ValueError(f"Path outside project root denied: {file_path}")
+    return resolved
+
+
+def make_source_code_reader(project_root: Path):
+    """Create a source-code reading tool bound to a specific project root.
+
+    All file access is confined to ``project_root``; requests that resolve
+    outside the boundary (via traversal or symlinks) are rejected. Binding the
+    root in a closure prevents the AI agent from being directed to read
+    arbitrary host files via prompt injection in artifact content.
+    """
+    root = project_root.resolve()
+
+    @tool
+    def read_source_code_file(file_path: str, max_lines: int = 200) -> str:
+        """Read the contents of a source code file within the project.
+
+        Args:
+            file_path: Path to the source code file, relative to the project root.
+            max_lines: Maximum number of lines to return (default 200).
+        """
+        try:
+            p = _resolve_within_project(root, file_path)
+        except ValueError as e:
+            return f"Error: {e}"
+        if not p.exists():
+            return f"Error: File not found: {file_path}"
+        if not p.is_file():
+            return f"Error: Not a file: {file_path}"
+        try:
+            content = p.read_text(encoding="utf-8", errors="ignore")
+            lines = content.split("\n")
+            if len(lines) > max_lines:
+                return "\n".join(lines[:max_lines]) + f"\n\n... ({len(lines) - max_lines} more lines truncated)"
+            return content
+        except Exception as e:
+            return f"Error reading file: {e}"
+
+    return read_source_code_file
 
 
 def create_req_story_agent(profile_name: str | None = None, region: str = "us-east-1") -> Agent:
@@ -156,8 +190,17 @@ def create_unit_component_agent(profile_name: str | None = None, region: str = "
     return Agent(model=model, tools=[], system_prompt=system_prompt)
 
 
-def create_component_code_agent(profile_name: str | None = None, region: str = "us-east-1") -> Agent:
-    """Create an agent focused on mapping components to code files (can read actual code)."""
+def create_component_code_agent(
+    project_root: Path,
+    profile_name: str | None = None,
+    region: str = "us-east-1",
+) -> Agent:
+    """Create an agent focused on mapping components to code files (can read actual code).
+
+    The agent's file-reading tool is confined to ``project_root`` so that
+    prompt injection in artifact content cannot direct it to read host files
+    outside the project boundary.
+    """
     model = create_bedrock_model(profile_name, region)
 
     system_prompt = """You are a component-to-code traceability specialist. Your ONLY job is to map logical components to the source code files that implement them.
@@ -181,7 +224,7 @@ def create_component_code_agent(profile_name: str | None = None, region: str = "
 
     return Agent(
         model=model,
-        tools=[read_source_code_file],
+        tools=[make_source_code_reader(project_root)],
         system_prompt=system_prompt,
     )
 
diff --git a/scripts/aidlc-traceability/src/traceability/discovery.py b/scripts/aidlc-traceability/src/traceability/discovery.py
index ff237b729..bd96393e4 100644
--- a/scripts/aidlc-traceability/src/traceability/discovery.py
+++ b/scripts/aidlc-traceability/src/traceability/discovery.py
@@ -90,12 +90,19 @@ def discover_source_code(project_root: Path) -> list[Path]:
     # File extensions to include
     code_extensions = {".py", ".js", ".ts", ".tsx", ".jsx"}
 
+    root_resolved = project_root.resolve()
+
     for dir_name in source_dirs:
         src_dir = project_root / dir_name
         if not src_dir.is_dir():
             continue
 
         for code_file in src_dir.rglob("*"):
+            # Skip symlinks: a symlink under src/ could point at a sensitive
+            # host file outside the project (CWE-59). Do not follow it.
+            if code_file.is_symlink():
+                continue
+
             # Skip if not a file
             if not code_file.is_file():
                 continue
@@ -108,6 +115,13 @@ def discover_source_code(project_root: Path) -> list[Path]:
             if any(excl in code_file.parts for excl in exclude_patterns):
                 continue
 
+            # Defense in depth: ensure the resolved path stays within the
+            # project root before reading it (guards against symlinked
+            # parent directories that rglob may have traversed).
+            resolved = code_file.resolve()
+            if resolved != root_resolved and root_resolved not in resolved.parents:
+                continue
+
             # Skip test files (but keep them if they're in tests/ for dedicated test parsing)
             rel_path = str(code_file.relative_to(project_root)).lower()
             if "test_" in code_file.name or "_test." in code_file.name or ".test." in code_file.name:
diff --git a/scripts/aidlc-traceability/src/traceability/generators/html.py b/scripts/aidlc-traceability/src/traceability/generators/html.py
index b3544cf42..202198667 100644
--- a/scripts/aidlc-traceability/src/traceability/generators/html.py
+++ b/scripts/aidlc-traceability/src/traceability/generators/html.py
@@ -379,7 +379,7 @@ def generate_html(report: TraceabilityReport, G: nx.DiGraph) -> str:
 
 <script>
 // Artifact data
-const artifacts = """ + json.dumps(artifact_data, indent=2) + """;
+const artifacts = """ + json.dumps(artifact_data, indent=2).replace("</", "<\\/") + """;
 
 let currentArtifact = null;
 
diff --git a/scripts/aidlc-traceability/src/traceability/pipeline.py b/scripts/aidlc-traceability/src/traceability/pipeline.py
index 72d7c14cf..5d346ad1f 100644
--- a/scripts/aidlc-traceability/src/traceability/pipeline.py
+++ b/scripts/aidlc-traceability/src/traceability/pipeline.py
@@ -213,7 +213,7 @@ def run_pipeline(
             # Stage 3d: Components → Code
             if components and code_artifacts:
                 console.print(f"  [bold cyan]Stage 3d:[/] Mapping {len(components)} components to {len(code_artifacts)} code files...")
-                agent_cc = create_component_code_agent(profile_name=aws_profile, region=aws_region)
+                agent_cc = create_component_code_agent(project_root, profile_name=aws_profile, region=aws_region)
                 cc_rels, cc_insights = run_component_code_analysis(agent_cc, components, code_artifacts)
                 all_relationships.extend(cc_rels)
                 ai_insights.extend(cc_insights)
diff --git a/scripts/aidlc-traceability/tests/test_agent_security.py b/scripts/aidlc-traceability/tests/test_agent_security.py
new file mode 100644
index 000000000..cdfd42f80
--- /dev/null
+++ b/scripts/aidlc-traceability/tests/test_agent_security.py
@@ -0,0 +1,76 @@
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2026 AIDLC Traceability Tool Contributors
+"""Security regression tests for the AI agent file-reading boundary (Finding 2)."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from traceability.agent import _resolve_within_project, make_source_code_reader
+
+
+class TestResolveWithinProject:
+    def test_relative_path_inside_root(self, tmp_path: Path):
+        (tmp_path / "src").mkdir()
+        target = tmp_path / "src" / "app.py"
+        target.write_text("x = 1\n")
+        resolved = _resolve_within_project(tmp_path, "src/app.py")
+        assert resolved == target.resolve()
+
+    def test_strips_code_prefix(self, tmp_path: Path):
+        (tmp_path / "src").mkdir()
+        (tmp_path / "src" / "app.py").write_text("")
+        resolved = _resolve_within_project(tmp_path, "CODE:src/app.py")
+        assert resolved == (tmp_path / "src" / "app.py").resolve()
+
+    def test_rejects_parent_traversal(self, tmp_path: Path):
+        project = tmp_path / "project"
+        project.mkdir()
+        with pytest.raises(ValueError):
+            _resolve_within_project(project, "../secret.txt")
+
+    def test_rejects_absolute_outside(self, tmp_path: Path):
+        project = tmp_path / "project"
+        project.mkdir()
+        with pytest.raises(ValueError):
+            _resolve_within_project(project, "/etc/passwd")
+
+
+class TestMakeSourceCodeReader:
+    def test_reads_file_within_root(self, tmp_path: Path):
+        (tmp_path / "src").mkdir()
+        (tmp_path / "src" / "app.py").write_text("hello = 1\n")
+        reader = make_source_code_reader(tmp_path)
+        result = reader("src/app.py")
+        assert "hello = 1" in result
+
+    def test_blocks_traversal_read(self, tmp_path: Path):
+        project = tmp_path / "project"
+        project.mkdir()
+        secret = tmp_path / "secret.txt"
+        secret.write_text("TOP SECRET\n")
+        reader = make_source_code_reader(project)
+        result = reader("../secret.txt")
+        assert "TOP SECRET" not in result
+        assert "denied" in result.lower()
+
+    def test_blocks_absolute_path_read(self, tmp_path: Path):
+        project = tmp_path / "project"
+        project.mkdir()
+        reader = make_source_code_reader(project)
+        result = reader("/etc/hosts")
+        assert "denied" in result.lower()
+
+    def test_blocks_symlink_escape(self, tmp_path: Path):
+        project = tmp_path / "project"
+        (project / "src").mkdir(parents=True)
+        secret = tmp_path / "secret.txt"
+        secret.write_text("TOP SECRET\n")
+        link = project / "src" / "leak.py"
+        link.symlink_to(secret)
+        reader = make_source_code_reader(project)
+        result = reader("src/leak.py")
+        assert "TOP SECRET" not in result
+        assert "denied" in result.lower()
diff --git a/scripts/aidlc-traceability/tests/test_discovery.py b/scripts/aidlc-traceability/tests/test_discovery.py
index b1d8cbd28..c8c58a186 100644
--- a/scripts/aidlc-traceability/tests/test_discovery.py
+++ b/scripts/aidlc-traceability/tests/test_discovery.py
@@ -108,3 +108,41 @@ def test_includes_js_ts(self, tmp_path: Path):
         (src / "Component.tsx").write_text("")
         files = discover_source_code(tmp_path)
         assert len(files) == 3
+
+    def test_skips_symlink_to_outside_file(self, tmp_path: Path):
+        """Finding 3 (CWE-59): a symlink in src/ pointing at a host file
+        outside the project must not be followed and read."""
+        project = tmp_path / "project"
+        src = project / "src"
+        src.mkdir(parents=True)
+        (src / "real.py").write_text("# real code\n")
+
+        # Sensitive file outside the project root
+        secret = tmp_path / "secret.py"
+        secret.write_text("SECRET = 'do-not-read'\n")
+
+        link = src / "leak.py"
+        link.symlink_to(secret)
+
+        files = discover_source_code(project)
+        names = [f.name for f in files]
+        assert "real.py" in names
+        assert "leak.py" not in names
+        assert secret not in [f.resolve() for f in files]
+
+    def test_skips_symlinked_directory(self, tmp_path: Path):
+        """A symlinked directory under src/ must not be traversed into."""
+        project = tmp_path / "project"
+        src = project / "src"
+        src.mkdir(parents=True)
+        (src / "real.py").write_text("")
+
+        outside = tmp_path / "outside"
+        outside.mkdir()
+        (outside / "leak.py").write_text("SECRET = 1\n")
+
+        (src / "linkdir").symlink_to(outside, target_is_directory=True)
+
+        files = discover_source_code(project)
+        resolved = [f.resolve() for f in files]
+        assert (outside / "leak.py").resolve() not in resolved
diff --git a/scripts/aidlc-traceability/tests/test_generators.py b/scripts/aidlc-traceability/tests/test_generators.py
index 44f15ef78..5b3c52e60 100644
--- a/scripts/aidlc-traceability/tests/test_generators.py
+++ b/scripts/aidlc-traceability/tests/test_generators.py
@@ -101,6 +101,34 @@ def test_escapes_special_chars(self):
         # The artifact title should be escaped (not rendered as raw HTML)
         assert '&lt;script&gt;alert("xss")&lt;/script&gt;' in html
 
+    def test_script_block_no_breakout(self):
+        """Finding 1 (CWE-79): a title containing </script> must not break out
+        of the embedded JSON <script> block."""
+        from traceability.models import Artifact, ArtifactType, TraceabilityReport, CoverageMetrics
+        arts = [
+            Artifact(
+                id="REQ-XSS",
+                title='</script><script>alert(1)</script>',
+                artifact_type=ArtifactType.REQUIREMENT,
+                description='foo </SCRIPT> bar',
+            )
+        ]
+        report = TraceabilityReport(
+            project_name="Proj",
+            artifacts=arts,
+            metrics=CoverageMetrics(total_requirements=1),
+        )
+        G, _ = build_graph(arts, [])
+        html = generate_html(report, G)
+
+        # The raw closing-tag sequences from the malicious title must never
+        # appear verbatim in the output; they must be neutralized to <\/ so the
+        # browser cannot terminate the <script> block early.
+        assert "</script><script>alert(1)" not in html
+        assert "</SCRIPT>" not in html
+        assert "<\\/script><script>alert(1)<\\/script>" in html
+        assert "foo <\\/SCRIPT> bar" in html
+
     def test_empty_report(self):
         from traceability.models import TraceabilityReport
         report = TraceabilityReport()