Which bug is this really?

Seven raw findings from an actual bash scan.sh run against vulnerable-repo/. All are genuine — the real triage skill here is mapping overlapping rule hits back to the ONE bug underneath, the exercise Task 3's triage table asks you to do yourself.