Summary

• When the server returns no scannable extensions for SAST (e.g. the customer has custom rules, so any text file is scannable), the CLI previously relied only on binary detection to filter files.
• Text-based non-source files — the EICAR test file (.bin) and ClamAV signature databases (.ndb) — slip past binary detection and get uploaded. Object-storage antivirus then quarantines the zip, so the scan service can't find the file and the scan fails with "Could not find uploaded file to scan".
• Adds a SAST fallback block-list (SAST_SCAN_FILE_EXTENSIONS_TO_IGNORE) used only when no server allow-list is present, plus a one-time debug log when the fallback is hit so this is diagnosable from logs.

Notes

• When the server does return scannable extensions, the allow-list takes priority and this fallback is never consulted (verified locally).
• Minimal AV-trigger set: .bin, .ndb, and common ClamAV signature-DB formats.

Jira

CM-65436