{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-ff666883dfa8755d", "name": "Stray `console.log` in TS/JS \u2014 fixtures/demo-app/src/invoices.ts:20", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 fixtures/demo-app/src/invoices.ts:20"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c983e7daadcf4536", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 fixtures/demo-app/src/Component.tsx:5", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 fixtures/demo-app/src/Component.tsx:5"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1ff022169a58bfe7", "name": "Stray `console.log` in TS/JS \u2014 fixtures/demo-app/src/orders.ts:20", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 fixtures/demo-app/src/orders.ts:20"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e16590341b7277cd", "name": "Stray `console.log` in TS/JS \u2014 scripts/gallery.ts:162", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/gallery.ts:162"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72d08fef4282bbe6", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/reporters/src/copilot/instructions.ts:31", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/reporters/src/copilot/instructions.ts:31"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8cc65e406b7451ff", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/scanners/test/pentest.test.ts:27", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/scanners/test/pentest.test.ts:27"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-89b022f9ca511990", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/scanners/src/adapters/pentest.ts:48", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/scanners/src/adapters/pentest.ts:48"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a7777378a5109cba", "name": "Runtime dotenv file present in repo: fixtures/demo-app/.env", "shortDescription": {"text": "Runtime dotenv file present in repo: fixtures/demo-app/.env"}, "fullDescription": {"text": "`fixtures/demo-app/.env` looks like a runtime dotenv file. It contains secret-looking assignments for VITE_PAYMENT_SECRET_KEY. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-175b413b54183b88", "name": "Insecure pattern 'dangerous_innerhtml' in README.md:135", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in README.md:135"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a26cab4931c9b0b3", "name": "Insecure pattern 'dangerous_innerhtml' in fixtures/demo-app/src/Component.tsx:5", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in fixtures/demo-app/src/Component.tsx:5"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-afb6a24e707690f6", "name": "Insecure pattern 'eval_used' in fixtures/demo-app/src/danger.ts:3", "shortDescription": {"text": "Insecure pattern 'eval_used' in fixtures/demo-app/src/danger.ts:3"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e5d905e175ac1026", "name": "Insecure pattern 'new_function_used' in fixtures/demo-app/src/danger.ts:4", "shortDescription": {"text": "Insecure pattern 'new_function_used' in fixtures/demo-app/src/danger.ts:4"}, "fullDescription": {"text": "Found a known-risky pattern (new_function_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1e2c82be6e024728", "name": "Insecure pattern 'new_function_used' in docs/gallery/code-report.html:326", "shortDescription": {"text": "Insecure pattern 'new_function_used' in docs/gallery/code-report.html:326"}, "fullDescription": {"text": "Found a known-risky pattern (new_function_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-85d8ef8d91a84e9f", "name": "Insecure pattern 'dangerous_innerhtml' in docs/gallery/code-report.html:319", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in docs/gallery/code-report.html:319"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1dbdbc764c06126c", "name": "Insecure pattern 'dangerous_innerhtml' in packages/reporters/src/copilot/instructions.ts:31", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in packages/reporters/src/copilot/instructions.ts:31"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-434affb8bc826f40", "name": "Insecure pattern 'cors_wildcard' in packages/reporters/src/copilot/instructions.ts:34", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in packages/reporters/src/copilot/instructions.ts:34"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c596bef5ff006f9d", "name": "Insecure pattern 'node_child_process' in packages/scanners/src/exec.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/scanners/src/exec.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-51181075dda2e10b", "name": "Insecure pattern 'new_function_used' in packages/scanners/src/adapters/pentest.ts:57", "shortDescription": {"text": "Insecure pattern 'new_function_used' in packages/scanners/src/adapters/pentest.ts:57"}, "fullDescription": {"text": "Found a known-risky pattern (new_function_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f462d849c005f177", "name": "Insecure pattern 'dangerous_innerhtml' in packages/scanners/src/adapters/pentest.ts:48", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in packages/scanners/src/adapters/pentest.ts:48"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7c1409c176b04eb0", "name": "Insecure pattern 'cors_wildcard' in packages/scanners/src/adapters/pentest.ts:42", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in packages/scanners/src/adapters/pentest.ts:42"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f774525e35947738", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/cache@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dde45dde7c6fe6f9", "name": "Node manifest has dependencies but no lockfile: fixtures/demo-app/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: fixtures/demo-app/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4de27e3844f256a2", "name": "Node manifest has dependencies but no lockfile: packages/reporters/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/reporters/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8c2e3196a4ef0cdd", "name": "Node manifest has dependencies but no lockfile: packages/cli/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/cli/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa81249860f6ea87", "name": "Node manifest has dependencies but no lockfile: packages/scanners/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/scanners/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dc7ed936de4e9274", "name": "Node manifest has dependencies but no lockfile: packages/history/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/history/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-28e92806c0db3cd2", "name": "Node manifest has dependencies but no lockfile: packages/core/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/core/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3c90c070a9971f59", "name": "Node manifest has dependencies but no lockfile: packages/action/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/action/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-87168da8780923a8", "name": "`fetch()` without try/.catch or AbortSignal \u2014 fixtures/demo-app/src/danger.ts:5", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 fixtures/demo-app/src/danger.ts:5"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/20427"}, "properties": {"repository": "subhashmahimaluri/pr-review-insight", "repoUrl": "https://github.com/subhashmahimaluri/pr-review-insight", "branch": "main"}, "results": [{"ruleId": "scanner-ff666883dfa8755d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 fixtures/demo-app/src/invoices.ts:20"}, "properties": {"repobilityId": "2067b69f60c062c6", "scanner": "scanner-primary", "fingerprint": "ff666883dfa8755d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c983e7daadcf4536", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 fixtures/demo-app/src/Component.tsx:5"}, "properties": {"repobilityId": "a6c3f6360b8ff0e2", "scanner": "scanner-primary", "fingerprint": "c983e7daadcf4536", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-1ff022169a58bfe7", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 fixtures/demo-app/src/orders.ts:20"}, "properties": {"repobilityId": "819a78fb8e12dbd0", "scanner": "scanner-primary", "fingerprint": "1ff022169a58bfe7", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-e16590341b7277cd", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/gallery.ts:162"}, "properties": {"repobilityId": "b8694deb9b266a26", "scanner": "scanner-primary", "fingerprint": "e16590341b7277cd", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-72d08fef4282bbe6", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/reporters/src/copilot/instructions.ts:31"}, "properties": {"repobilityId": "f54e714f737da50c", "scanner": "scanner-primary", "fingerprint": "72d08fef4282bbe6", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-8cc65e406b7451ff", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/scanners/test/pentest.test.ts:27"}, "properties": {"repobilityId": "e9d756f71dd43548", "scanner": "scanner-primary", "fingerprint": "8cc65e406b7451ff", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-89b022f9ca511990", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 packages/scanners/src/adapters/pentest.ts:48"}, "properties": {"repobilityId": "b18b1023007ac5ea", "scanner": "scanner-primary", "fingerprint": "89b022f9ca511990", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-a7777378a5109cba", "level": "error", "message": {"text": "Runtime dotenv file present in repo: fixtures/demo-app/.env"}, "properties": {"repobilityId": "157fe4c36a3fa8ec", "scanner": "scanner-primary", "fingerprint": "a7777378a5109cba", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets", "config", "env-file", "runtime-env", "env_file_with_secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fixtures/demo-app/.env"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-175b413b54183b88", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in README.md:135"}, "properties": {"repobilityId": "d00ca9e2b6d40469", "scanner": "scanner-primary", "fingerprint": "175b413b54183b88", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "README.md"}, "region": {"startLine": 135}}}]}, {"ruleId": "scanner-a26cab4931c9b0b3", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in fixtures/demo-app/src/Component.tsx:5"}, "properties": {"repobilityId": "6860c5408353bf84", "scanner": "scanner-primary", "fingerprint": "a26cab4931c9b0b3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fixtures/demo-app/src/Component.tsx"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-afb6a24e707690f6", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in fixtures/demo-app/src/danger.ts:3"}, "properties": {"repobilityId": "6372e67ada834e86", "scanner": "scanner-primary", "fingerprint": "afb6a24e707690f6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fixtures/demo-app/src/danger.ts"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-e5d905e175ac1026", "level": "error", "message": {"text": "Insecure pattern 'new_function_used' in fixtures/demo-app/src/danger.ts:4"}, "properties": {"repobilityId": "e84fba856fb7f397", "scanner": "scanner-primary", "fingerprint": "e5d905e175ac1026", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "new_function_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fixtures/demo-app/src/danger.ts"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-1e2c82be6e024728", "level": "error", "message": {"text": "Insecure pattern 'new_function_used' in docs/gallery/code-report.html:326"}, "properties": {"repobilityId": "4428210abd667c7e", "scanner": "scanner-primary", "fingerprint": "1e2c82be6e024728", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "new_function_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/gallery/code-report.html"}, "region": {"startLine": 326}}}]}, {"ruleId": "scanner-85d8ef8d91a84e9f", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in docs/gallery/code-report.html:319"}, "properties": {"repobilityId": "a1391cfc982caa90", "scanner": "scanner-primary", "fingerprint": "85d8ef8d91a84e9f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/gallery/code-report.html"}, "region": {"startLine": 319}}}]}, {"ruleId": "scanner-1dbdbc764c06126c", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in packages/reporters/src/copilot/instructions.ts:31"}, "properties": {"repobilityId": "42c4aca2841dd96a", "scanner": "scanner-primary", "fingerprint": "1dbdbc764c06126c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/reporters/src/copilot/instructions.ts"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-434affb8bc826f40", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in packages/reporters/src/copilot/instructions.ts:34"}, "properties": {"repobilityId": "fc31572afd3f1fe6", "scanner": "scanner-primary", "fingerprint": "434affb8bc826f40", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/reporters/src/copilot/instructions.ts"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-c596bef5ff006f9d", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/scanners/src/exec.ts:1"}, "properties": {"repobilityId": "089cc70f2f7705f2", "scanner": "scanner-primary", "fingerprint": "c596bef5ff006f9d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/scanners/src/exec.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-51181075dda2e10b", "level": "error", "message": {"text": "Insecure pattern 'new_function_used' in packages/scanners/src/adapters/pentest.ts:57"}, "properties": {"repobilityId": "cfd9179696fdc865", "scanner": "scanner-primary", "fingerprint": "51181075dda2e10b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "new_function_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/scanners/src/adapters/pentest.ts"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-f462d849c005f177", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in packages/scanners/src/adapters/pentest.ts:48"}, "properties": {"repobilityId": "7230c823d68d805f", "scanner": "scanner-primary", "fingerprint": "f462d849c005f177", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/scanners/src/adapters/pentest.ts"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-7c1409c176b04eb0", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in packages/scanners/src/adapters/pentest.ts:42"}, "properties": {"repobilityId": "3de2dd6e834745a7", "scanner": "scanner-primary", "fingerprint": "7c1409c176b04eb0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/scanners/src/adapters/pentest.ts"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-f774525e35947738", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "31aadf974827a50b", "scanner": "scanner-primary", "fingerprint": "f774525e35947738", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/mutation.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-dde45dde7c6fe6f9", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: fixtures/demo-app/package.json"}, "properties": {"repobilityId": "d07f6207a32e42b6", "scanner": "scanner-primary", "fingerprint": "dde45dde7c6fe6f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fixtures/demo-app/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4de27e3844f256a2", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/reporters/package.json"}, "properties": {"repobilityId": "b4bcfb394bf2f328", "scanner": "scanner-primary", "fingerprint": "4de27e3844f256a2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/reporters/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8c2e3196a4ef0cdd", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/cli/package.json"}, "properties": {"repobilityId": "2faf23490612d7a6", "scanner": "scanner-primary", "fingerprint": "8c2e3196a4ef0cdd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cli/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa81249860f6ea87", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/scanners/package.json"}, "properties": {"repobilityId": "0d98532674a58b85", "scanner": "scanner-primary", "fingerprint": "aa81249860f6ea87", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/scanners/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dc7ed936de4e9274", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/history/package.json"}, "properties": {"repobilityId": "fc684c357df3aefe", "scanner": "scanner-primary", "fingerprint": "dc7ed936de4e9274", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/history/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-28e92806c0db3cd2", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/core/package.json"}, "properties": {"repobilityId": "8640e46be7e3f9b2", "scanner": "scanner-primary", "fingerprint": "28e92806c0db3cd2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/core/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3c90c070a9971f59", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/action/package.json"}, "properties": {"repobilityId": "6aa23b5273c9ed79", "scanner": "scanner-primary", "fingerprint": "3c90c070a9971f59", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/action/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "fc28a8d109c04131", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "5175507e8b6eb230", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "ffae0d63a61eccf6", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-87168da8780923a8", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 fixtures/demo-app/src/danger.ts:5"}, "properties": {"repobilityId": "024bb0b6c1dd7a00", "scanner": "scanner-primary", "fingerprint": "87168da8780923a8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}]}]}