I ran the QS tools report against the root of the quickstarts, but it did not catch the hardcoded 'jboss-as-propagation-ejb' in the ejb-security-propagation/ejb/pom.xml file:

<build>
<!-- Set the name of the war, used as the context root when the app is
deployed -->
<finalName>jboss-as-propagation-ejb</finalName>
<plugins>
<!-- JBoss AS plugin to deploy war -->
<plugin>