{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-87cfc525ccbac7c3", "name": "Possibly dead Python function: install_single_codex_package_archive", "shortDescription": {"text": "Possibly dead Python function: install_single_codex_package_archive"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2250301f6686b9d6", "name": "Possibly dead Python function: install_single_binary", "shortDescription": {"text": "Possibly dead Python function: install_single_binary"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a5c0f82fd3ee34ce", "name": "Possibly dead Python function: handler", "shortDescription": {"text": "Possibly dead Python function: handler"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-495cde7d43785445", "name": "Possibly dead Python function: current_sdk_version", "shortDescription": {"text": "Possibly dead Python function: current_sdk_version"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0d1dae851bd7fd96", "name": "Possibly dead Python function: request_with_retry_on_overload", "shortDescription": {"text": "Possibly dead Python function: request_with_retry_on_overload"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c77d6a3ad34efda9", "name": "Possibly dead Python function: default_codex_home", "shortDescription": {"text": "Possibly dead Python function: default_codex_home"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dd93029e6ce7340d", "name": "Possibly dead Python function: begin_interrupt", "shortDescription": {"text": "Possibly dead Python function: begin_interrupt"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-20767039b6113e12", "name": "Possibly dead Python function: confirm_interrupt", "shortDescription": {"text": "Possibly dead Python function: confirm_interrupt"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a61c762302b0578", "name": "Possibly dead Python function: cancel_interrupt", "shortDescription": {"text": "Possibly dead Python function: cancel_interrupt"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b1c115bfdbfaee17", "name": "Possibly dead Python function: active_turn", "shortDescription": {"text": "Possibly dead Python function: active_turn"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b5d7c01b70a26322", "name": "Possibly dead Python function: resolve_active_turn", "shortDescription": {"text": "Possibly dead Python function: resolve_active_turn"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fffbd097ebb5cdf1", "name": "Possibly dead Python function: login_chatgpt_device_code", "shortDescription": {"text": "Possibly dead Python function: login_chatgpt_device_code"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-df1443ef4b3c35ea", "name": "Possibly dead Python function: logout", "shortDescription": {"text": "Possibly dead Python function: logout"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5b2e5a8d7026a4af", "name": "Possibly dead Python function: start_operation", "shortDescription": {"text": "Possibly dead Python function: start_operation"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1b7f45d695a692f7", "name": "Possibly dead Python function: cleanup_cancelled_start", "shortDescription": {"text": "Possibly dead Python function: cleanup_cancelled_start"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b4ca43fa964932a6", "name": "Possibly dead Python function: stop_cancelled_goal", "shortDescription": {"text": "Possibly dead Python function: stop_cancelled_goal"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-24d443735275f6ee", "name": "Possibly dead Python function: request_with_retry_on_overload", "shortDescription": {"text": "Possibly dead Python function: request_with_retry_on_overload"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7cc7823aabf9e1f4", "name": "TODO/FIXME marker in shipping code \u2014 sdk/typescript/tests/run.test.ts:773", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 sdk/typescript/tests/run.test.ts:773"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e04b4e058df01fe7", "name": "Stray `console.log` in TS/JS \u2014 sdk/typescript/samples/structured_output.ts:22", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 sdk/typescript/samples/structured_output.ts:22"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6e6908538b45f380", "name": "Stray `console.log` in TS/JS \u2014 sdk/typescript/samples/basic_streaming.ts:17", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 sdk/typescript/samples/basic_streaming.ts:17"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-10320694a80b1113", "name": "Stray `console.log` in TS/JS \u2014 sdk/typescript/samples/structured_output_zod.ts:19", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 sdk/typescript/samples/structured_output_zod.ts:19"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-41b925ef6ba0de7b", "name": "dynamic urllib use detected \u2014 codex-rs/scripts/write_model_compatibility_catalog.py:22", "shortDescription": {"text": "dynamic urllib use detected \u2014 codex-rs/scripts/write_model_compatibility_catalog.py:22"}, "fullDescription": {"text": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\nRule: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected\nSeverity: WARNING\nOWASP: A, 0, 1, :, 2, 0, 1, 7,  , -,  , I, n, j, e, c, t, i, o, n\nCWE: CWE-939: Improper Authorization in Handler for Custom URL Scheme\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0576a1647d6b7c6e", "name": "dynamic urllib use detected \u2014 codex-rs/scripts/write_provider_catalog.py:35", "shortDescription": {"text": "dynamic urllib use detected \u2014 codex-rs/scripts/write_provider_catalog.py:35"}, "fullDescription": {"text": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\nRule: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected\nSeverity: WARNING\nOWASP: A, 0, 1, :, 2, 0, 1, 7,  , -,  , I, n, j, e, c, t, i, o, n\nCWE: CWE-939: Improper Authorization in Handler for Custom URL Scheme\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-20203a76a8fb3150", "name": "dynamic urllib use detected \u2014 codex-rs/scripts/write_provider_catalog.py:191", "shortDescription": {"text": "dynamic urllib use detected \u2014 codex-rs/scripts/write_provider_catalog.py:191"}, "fullDescription": {"text": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\nRule: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected\nSeverity: WARNING\nOWASP: A, 0, 1, :, 2, 0, 1, 7,  , -,  , I, n, j, e, c, t, i, o, n\nCWE: CWE-939: Improper Authorization in Handler for Custom URL Scheme\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-da9d2d12885a4c19", "name": "dynamic urllib use detected \u2014 codex-rs/skills/src/assets/samples/skill-installer/scripts/github_utils.py:16", "shortDescription": {"text": "dynamic urllib use detected \u2014 codex-rs/skills/src/assets/samples/skill-installer/scripts/github_utils.py:16"}, "fullDescription": {"text": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\nRule: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected\nSeverity: WARNING\nOWASP: A, 0, 1, :, 2, 0, 1, 7,  , -,  , I, n, j, e, c, t, i, o, n\nCWE: CWE-939: Improper Authorization in Handler for Custom URL Scheme\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c5c7423e95a82ee1", "name": "dynamic urllib use detected \u2014 scripts/codex_package/dotslash.py:170", "shortDescription": {"text": "dynamic urllib use detected \u2014 scripts/codex_package/dotslash.py:170"}, "fullDescription": {"text": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\nRule: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected\nSeverity: WARNING\nOWASP: A, 0, 1, :, 2, 0, 1, 7,  , -,  , I, n, j, e, c, t, i, o, n\nCWE: CWE-939: Improper Authorization in Handler for Custom URL Scheme\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d33709d0ccb2f0e4", "name": "dynamic urllib use detected \u2014 scripts/codex_package/v8.py:175", "shortDescription": {"text": "dynamic urllib use detected \u2014 scripts/codex_package/v8.py:175"}, "fullDescription": {"text": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\nRule: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected\nSeverity: WARNING\nOWASP: A, 0, 1, :, 2, 0, 1, 7,  , -,  , I, n, j, e, c, t, i, o, n\nCWE: CWE-939: Improper Authorization in Handler for Custom URL Scheme\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4fdcc124ed1d5a11", "name": "dynamic urllib use detected \u2014 sdk/python/_runtime_setup.py:154", "shortDescription": {"text": "dynamic urllib use detected \u2014 sdk/python/_runtime_setup.py:154"}, "fullDescription": {"text": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\nRule: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected\nSeverity: WARNING\nOWASP: A, 0, 1, :, 2, 0, 1, 7,  , -,  , I, n, j, e, c, t, i, o, n\nCWE: CWE-939: Improper Authorization in Handler for Custom URL Scheme\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-824153fe8d59e096", "name": "dynamic urllib use detected \u2014 sdk/python/_runtime_setup.py:182", "shortDescription": {"text": "dynamic urllib use detected \u2014 sdk/python/_runtime_setup.py:182"}, "fullDescription": {"text": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\nRule: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected\nSeverity: WARNING\nOWASP: A, 0, 1, :, 2, 0, 1, 7,  , -,  , I, n, j, e, c, t, i, o, n\nCWE: CWE-939: Improper Authorization in Handler for Custom URL Scheme\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fab56267c67ea208", "name": "dynamic urllib use detected \u2014 sdk/python/_runtime_setup.py:214", "shortDescription": {"text": "dynamic urllib use detected \u2014 sdk/python/_runtime_setup.py:214"}, "fullDescription": {"text": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\nRule: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected\nSeverity: WARNING\nOWASP: A, 0, 1, :, 2, 0, 1, 7,  , -,  , I, n, j, e, c, t, i, o, n\nCWE: CWE-939: Improper Authorization in Handler for Custom URL Scheme\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-edfba94b43f56e04", "name": "GHSA-xhj4-vrgc-hr34: actix-http 3.11.2 \u2014 codex-rs/Cargo.lock", "shortDescription": {"text": "GHSA-xhj4-vrgc-hr34: actix-http 3.11.2 \u2014 codex-rs/Cargo.lock"}, "fullDescription": {"text": "actix-http has HTTP/1.1 CL.TE Request Smuggling \n\nA vulnerability in `actix-http`'s HTTP/1.1 request parser allows an unauthenticated remote client to smuggle requests in deployments where a front-end HTTP intermediary and the Actix backend disagree about whether `Content-Length` or `Transfer-Encoding: chunked` defines the request body length.\n\n## Severity\n\n**Medium**.\nThis is an HTTP request smuggling vulnerability that can be triggered over the network without application-level credentials. Exploitation requires a specific proxy topology: an \n\nPackage: actix-http\nInstalled: 3.11.2\nFixed in: 3.12.1\nSeverity: MEDIUM\nFix: Upgrade actix-http to 3.12.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5357a2a3690a2685", "name": "CVE-2026-50185: cmov 0.5.3 \u2014 codex-rs/Cargo.lock", "shortDescription": {"text": "CVE-2026-50185: cmov 0.5.3 \u2014 codex-rs/Cargo.lock"}, "fullDescription": {"text": "RustCrypto CMOV provides conditional move CPU intrinsics which are gua ...\n\nRustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time and not be rewritten as branches by the compiler. From 0.1.1 until 0.5.4, the aarch64 implementations of Cmov and CmovEq in cmov/src/backends/aarch64.rs assume high bits are zero-extended when loading values smaller than a register, so set high bits such as [8..] in a Cmov selector or [16..] of self or other in the u16 and i16 CmovEq implementations can cause left.cmovz(&r\n\nPackage: cmov\nInstalled: 0.5.3\nFixed in: 0.5.4\nSeverity: MEDIUM\nFix: Upgrade cmov to 0.5.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bf9bf1f56cc17cc3", "name": "CVE-2026-40034: gix 0.81.0 \u2014 codex-rs/Cargo.lock", "shortDescription": {"text": "CVE-2026-40034: gix 0.81.0 \u2014 codex-rs/Cargo.lock"}, "fullDescription": {"text": "gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0 ...\n\ngix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in .git/config. An attacker can inject arbitrary shell commands via the update field in .gitmodules that will be executed when Submodule::update() is called on a previously-initialized submodule, enabling remote code executio\n\nPackage: gix\nInstalled: 0.81.0\nFixed in: 0.83.0\nSeverity: HIGH\nFix: Upgrade gix to 0.83.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3a488955e89a6206", "name": "GHSA-fr8x-3vfx-f45h: gix 0.81.0 \u2014 codex-rs/Cargo.lock", "shortDescription": {"text": "GHSA-fr8x-3vfx-f45h: gix 0.81.0 \u2014 codex-rs/Cargo.lock"}, "fullDescription": {"text": "gix and gitoxide: unvalidated submodule name traverses out of .git/modules and redirects state() / open() to another repository\n\n## **Summary**\nattachments:\n[pocs.zip](https://github.com/user-attachments/files/26431422/pocs.zip)\n\nSubmodule names coming from `.gitmodules` are exposed as unvalidated names and are later reused to derive the submodule git directory as:\n\n```\n<superproject common_dir>/modules/<submodule name>\n```\n\nBecause the submodule name is joined directly as a filesystem path component, a name such as `../../../escaped-target.git` escapes `.git/modules` after normalization. The current implementation then u\n\nPackage: gix\nInstalled: 0.81.0\nFixed in: 0.83.0\nSeverity: HIGH\nFix: Upgrade gix to 0.83.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-745db865016a7a0e", "name": "GHSA-p3hw-mv63-rf9w: gix 0.81.0 \u2014 codex-rs/Cargo.lock", "shortDescription": {"text": "GHSA-p3hw-mv63-rf9w: gix 0.81.0 \u2014 codex-rs/Cargo.lock"}, "fullDescription": {"text": "gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosure\n\n### Summary\n\nSubmodule name validation bypass plus missing validation in production code paths allows path traversal via crafted `.gitmodules`. Combined with a trust inheritance flaw in `Submodule::open()`, this enables reading arbitrary git repository configs (including credentials) from traversed paths with full trust (CWE-22, CWE-200).\n\n### Details\n\n**Bug 1: Validation bypass in `gix-validate/src/submodule.rs` (lines 27-42)**\n\nThe `name()` function uses `name.find(b\"..\")` which returns only t\n\nPackage: gix\nInstalled: 0.81.0\nFixed in: 0.83.0\nSeverity: HIGH\nFix: Upgrade gix to 0.83.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7c8f63b97a4f059c", "name": "GHSA-pg4w-g64p-qwhj: gix 0.81.0 \u2014 codex-rs/Cargo.lock", "shortDescription": {"text": "GHSA-pg4w-g64p-qwhj: gix 0.81.0 \u2014 codex-rs/Cargo.lock"}, "fullDescription": {"text": "gix and gitoxide's symlinked .gitmodules are followed and parsed from outside of the repository\n\n## Summary\nattachments:\n[pocs.zip](https://github.com/user-attachments/files/26431422/pocs.zip)\n\n\nWhen `Repository::submodules()` loads submodule metadata, it prefers the worktree `.gitmodules` file if that path exists. In the current implementation, the path is read with `std::fs::read()`, which follows symlinks. As a result, a repository can present a symlinked `.gitmodules` that points outside the repository, and gitoxide will parse the out-of-repository bytes as submodule configuration.\n\nThi\n\nPackage: gix\nInstalled: 0.81.0\nFixed in: 0.83.0\nSeverity: HIGH\nFix: Upgrade gix to 0.83.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7e531cebb0fd11e1", "name": "CVE-2026-44471: gix-fs 0.19.2 \u2014 codex-rs/Cargo.lock", "shortDescription": {"text": "CVE-2026-44471: gix-fs 0.19.2 \u2014 codex-rs/Cargo.lock"}, "fullDescription": {"text": "gitoxide is an implementation of git written in Rust. Prior to 0.21.1, ...\n\ngitoxide is an implementation of git written in Rust. Prior to 0.21.1, a malicious tree can be constructed that will, when checked out with gitoxide, permit writing an attacker-controlled symlink into any existing directory the user has write access to. During checkout, all symlink index entries are deferred and created after regular files using a single shared gix_worktree::Stack. Internally, this uses a gix_fs::Stack. gix_fs::Stack::make_relative_path_current() caches validated path prefixes: \n\nPackage: gix-fs\nInstalled: 0.19.2\nFixed in: 0.21.1\nSeverity: HIGH\nFix: Upgrade gix-fs to 0.21.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8f1aac0741f67a61", "name": "GHSA-x494-mj8g-cj27: gix-pack 0.68.0 \u2014 codex-rs/Cargo.lock", "shortDescription": {"text": "GHSA-x494-mj8g-cj27: gix-pack 0.68.0 \u2014 codex-rs/Cargo.lock"}, "fullDescription": {"text": "gix-pack has multiple DoS vectors: unchecked indexing panics and uncapped OOM allocations from crafted pack data\n\n### Summary\n\nMultiple denial-of-service vectors in `gix-pack`: unchecked array indexing causes panics on crafted delta data, and uncapped attacker-controlled size headers enable OOM process kills. Both are triggered by malicious pack data received during clone/fetch.\n\n### Details\n\n**Bug 1: Unchecked array indexing in delta application (CWE-248)**\n\nThe `apply()` function in `gix-pack/src/data/delta.rs` (lines 33-87) reads delta instructions using unchecked `data[i]` indexing at 7 locations (lines\n\nPackage: gix-pack\nInstalled: 0.68.0\nFixed in: 0.69.0\nSeverity: HIGH\nFix: Upgrade gix-pack to 0.69.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b9f85814dd9d9600", "name": "GHSA-9857-6mw7-fq2m: gix-transport 0.55.1 \u2014 codex-rs/Cargo.lock", "shortDescription": {"text": "GHSA-9857-6mw7-fq2m: gix-transport 0.55.1 \u2014 codex-rs/Cargo.lock"}, "fullDescription": {"text": "gix-transport: HTTP credentials leaked to redirected host in curl backend\n\n## Summary\n\nThe curl-based HTTP transport in `gix-transport` sends user credentials (passwords, tokens) to an attacker-controlled server after an HTTP redirect. When a server responds with a 302 redirect during the initial `GET /info/refs`, gitoxide records the redirected base URL and rewrites all subsequent requests to point at the redirected host. The `Authorization` header is still attached because `add_basic_auth_if_present()` only checks `self.url` (the original, never-updated URL).\n\nThe re\n\nPackage: gix-transport\nInstalled: 0.55.1\nFixed in: 0.56.0\nSeverity: MEDIUM\nFix: Upgrade gix-transport to 0.56.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8a702e857511aec4", "name": "GHSA-p3hw-mv63-rf9w: gix-validate 0.11.0 \u2014 codex-rs/Cargo.lock", "shortDescription": {"text": "GHSA-p3hw-mv63-rf9w: gix-validate 0.11.0 \u2014 codex-rs/Cargo.lock"}, "fullDescription": {"text": "gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosure\n\n### Summary\n\nSubmodule name validation bypass plus missing validation in production code paths allows path traversal via crafted `.gitmodules`. Combined with a trust inheritance flaw in `Submodule::open()`, this enables reading arbitrary git repository configs (including credentials) from traversed paths with full trust (CWE-22, CWE-200).\n\n### Details\n\n**Bug 1: Validation bypass in `gix-validate/src/submodule.rs` (lines 27-42)**\n\nThe `name()` function uses `name.find(b\"..\")` which returns only t\n\nPackage: gix-validate\nInstalled: 0.11.0\nFixed in: 0.11.1\nSeverity: HIGH\nFix: Upgrade gix-validate to 0.11.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8124b3dbdb5e20af", "name": "GHSA-3v94-mw7p-v465: hickory-proto 0.25.2 \u2014 codex-rs/Cargo.lock", "shortDescription": {"text": "GHSA-3v94-mw7p-v465: hickory-proto 0.25.2 \u2014 codex-rs/Cargo.lock"}, "fullDescription": {"text": "hickory-proto: NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses\n\nThe NSEC3 closest-encloser proof validation in `hickory-proto`'s (0.25.0-alpha.3 ... 0.25.2) and `hickory-net`'s (0.26.0-alpha.1 .. 0.26.0)  `DnssecDnsHandle` walks from the QNAME up to the SOA owner name, building a list of candidate encloser names. The iterator used assumes the QNAME is a descendant of the SOA owner, terminating only when the current candidate equals the SOA name. When the SOA in a response's authority section is not an ancestor of the QNAME, the loop stalls at the DNS root an\n\nPackage: hickory-proto\nInstalled: 0.25.2\nFixed in: \u2014\nSeverity: HIGH\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-df1cbe7f37250bdd", "name": "GHSA-q2qq-hmj6-3wpp: hickory-proto 0.25.2 \u2014 codex-rs/Cargo.lock", "shortDescription": {"text": "GHSA-q2qq-hmj6-3wpp: hickory-proto 0.25.2 \u2014 codex-rs/Cargo.lock"}, "fullDescription": {"text": "hickory-proto vulnerable to CPU exhaustion during message encoding due to O(n\u00b2) name compression\n\nDuring message encoding, `hickory-proto`'s `BinEncoder` stores pointers to labels that are candidates for name compression in a `Vec<(usize, Vec<u8>)>`. The name compression logic then searches for matches with a linear scan.\n\nA malicious message with many records can both introduce many candidate labels, and invoke this linear scan many times. This can amplify CPU exhaustion in DoS attacks.\n\nThis is similar to [CVE-2024-8508](https://www.nlnetlabs.nl/downloads/unbound/CVE-2024-8508.txt).\n\n### R\n\nPackage: hickory-proto\nInstalled: 0.25.2\nFixed in: 0.26.1\nSeverity: MEDIUM\nFix: Upgrade hickory-proto to 0.26.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c28b4033a2cf01b", "name": "CVE-2026-25537: jsonwebtoken 9.3.1 \u2014 codex-rs/Cargo.lock", "shortDescription": {"text": "CVE-2026-25537: jsonwebtoken 9.3.1 \u2014 codex-rs/Cargo.lock"}, "fullDescription": {"text": "jsonwebtoken: jsonwebtoken has Type Confusion that leads to potential authorization bypass\n\njsonwebtoken is a JWT lib in rust. Prior to version 10.3.0, there is a Type Confusion vulnerability in jsonwebtoken, specifically, in its claim validation logic. When a standard claim (such as nbf or exp) is provided with an incorrect JSON type (Like a String instead of a Number), the library\u2019s internal parsing mechanism marks the claim as \u201cFailedToParse\u201d. Crucially, the validation logic treats this \u201cFailedToParse\u201d state identically to \u201cNotPresent\u201d. This means that if a check is enabled (like: v\n\nPackage: jsonwebtoken\nInstalled: 9.3.1\nFixed in: 10.3.0\nSeverity: MEDIUM\nFix: Upgrade jsonwebtoken to 10.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-93ff0b9f0fb0fde4", "name": "GHSA-rhfx-m35p-ff5j: lru 0.12.5 \u2014 codex-rs/Cargo.lock", "shortDescription": {"text": "GHSA-rhfx-m35p-ff5j: lru 0.12.5 \u2014 codex-rs/Cargo.lock"}, "fullDescription": {"text": "`IterMut` violates Stacked Borrows by invalidating internal pointer\n\nAffected versions of this crate contain a soundness issue in the `IterMut` iterator implementation. The `IterMut::next` and `IterMut::next_back` methods temporarily create an exclusive reference to the key when dereferencing the internal node pointer.\n\nThis invalidates the shared pointer held by the internal `HashMap`, violating Stacked Borrows rules.\n\nPackage: lru\nInstalled: 0.12.5\nFixed in: 0.16.3\nSeverity: LOW\nFix: Upgrade lru to 0.16.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6a33f7a39316cef4", "name": "CVE-2026-41676: openssl 0.10.75 \u2014 codex-rs/Cargo.lock", "shortDescription": {"text": "CVE-2026-41676: openssl 0.10.75 \u2014 codex-rs/Cargo.lock"}, "fullDescription": {"text": "rust-openssl provides OpenSSL bindings for the Rust programming langua ...\n\nrust-openssl provides OpenSSL bindings for the Rust programming language.  From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, relying on OpenSSL to honor it. On OpenSSL 1.1.x, X25519, X448, DH and HKDF-extract ignore the incoming *keylen, unconditionally writing the full shared secret (32/56/prime-size bytes). A caller passing a short slice gets a heap/stack overflow from safe code. OpenSSL 3.x provi\n\nPackage: openssl\nInstalled: 0.10.75\nFixed in: 0.10.78\nSeverity: HIGH\nFix: Upgrade openssl to 0.10.78"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-45a528aaa4839307", "name": "CVE-2026-41678: openssl 0.10.75 \u2014 codex-rs/Cargo.lock", "shortDescription": {"text": "CVE-2026-41678: openssl 0.10.75 \u2014 codex-rs/Cargo.lock"}, "fullDescription": {"text": "rust-openssl provides OpenSSL bindings for the Rust programming langua ...\n\nrust-openssl provides OpenSSL bindings for the Rust programming language.  From  to before 0.10.78, aes::unwrap_key() contains an incorrect assertion: it checks that out.len() + 8 <= in_.len(), but this condition is reversed. The intended invariant is out.len() >= in_.len() - 8, ensuring the output buffer is large enough. Because of the inverted check, the function only accepts buffers at or below the minimum required size and rejects larger ones. If a smaller buffer is provided the function wil\n\nPackage: openssl\nInstalled: 0.10.75\nFixed in: 0.10.78\nSeverity: HIGH\nFix: Upgrade openssl to 0.10.78"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-25e964da0f446016", "name": "CVE-2026-41681: openssl 0.10.75 \u2014 codex-rs/Cargo.lock", "shortDescription": {"text": "CVE-2026-41681: openssl 0.10.75 \u2014 codex-rs/Cargo.lock"}, "fullDescription": {"text": "rust-openssl provides OpenSSL bindings for the Rust programming langua ...\n\nrust-openssl provides OpenSSL bindings for the Rust programming language.  From 0.10.39 to before 0.10.78, EVP_DigestFinal() always writes EVP_MD_CTX_size(ctx) to the out buffer. If out is smaller than that, MdCtxRef::digest_final() writes past its end, usually corrupting the stack. This is reachable from safe Rust. This vulnerability is fixed in 0.10.78.\n\nPackage: openssl\nInstalled: 0.10.75\nFixed in: 0.10.78\nSeverity: HIGH\nFix: Upgrade openssl to 0.10.78"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5d91e3442a5a5de5", "name": "CVE-2026-41898: openssl 0.10.75 \u2014 codex-rs/Cargo.lock", "shortDescription": {"text": "CVE-2026-41898: openssl 0.10.75 \u2014 codex-rs/Cargo.lock"}, "fullDescription": {"text": "rust-openssl provides OpenSSL bindings for the Rust programming langua ...\n\nrust-openssl provides OpenSSL bindings for the Rust programming language.  From 0.9.24 to before 0.10.78, the FFI trampolines behind SslContextBuilder::set_psk_client_callback, set_psk_server_callback, set_cookie_generate_cb, and set_stateless_cookie_generate_cb forwarded the user closure's returned usize directly to OpenSSL without checking it against the &mut [u8] that was handed to the closure. This can lead to buffer overflows and other unintended consequences. This vulnerability is fixed in\n\nPackage: openssl\nInstalled: 0.10.75\nFixed in: 0.10.78\nSeverity: HIGH\nFix: Upgrade openssl to 0.10.78"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e8134905aeb744b3", "name": "CVE-2026-42327: openssl 0.10.75 \u2014 codex-rs/Cargo.lock", "shortDescription": {"text": "CVE-2026-42327: openssl 0.10.75 \u2014 codex-rs/Cargo.lock"}, "fullDescription": {"text": "rust-openssl: rust-openssl: Arbitrary code execution via specially crafted certificate\n\nrust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79, X509Ref::ocsp_responders returns OCSP responder URLs from a certificate's AIA extension as OpensslString, whose Deref<Target = str> wraps the raw bytes with str::from_utf8_unchecked. OpenSSL does not enforce that the underlying IA5String is ASCII, so a certificate with non-UTF-8 bytes in its OCSP accessLocation causes safe Rust code to construct a &str that violates the UTF-8 invariant \u2014 resul\n\nPackage: openssl\nInstalled: 0.10.75\nFixed in: 0.10.79\nSeverity: HIGH\nFix: Upgrade openssl to 0.10.79"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-796760b8068f816b", "name": "CVE-2026-44662: openssl 0.10.75 \u2014 codex-rs/Cargo.lock", "shortDescription": {"text": "CVE-2026-44662: openssl 0.10.75 \u2014 codex-rs/Cargo.lock"}, "fullDescription": {"text": "rust-openssl provides OpenSSL bindings for the Rust programming langua ...\n\nrust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.0 to before 0.10.79, CipherCtxRef::cipher_update, CipherCtxRef::cipher_update_vec, and symm::Crypter::update incorrectly sized output buffers when used with AES key-wrap-with-padding ciphers (EVP_aes_{128,192,256}_wrap_pad). For a non-multiple-of-8 input, OpenSSL writes up to 7 bytes past the end of the caller's buffer or Vec, producing attacker-controllable heap corruption when the plaintext length is attacker-i\n\nPackage: openssl\nInstalled: 0.10.75\nFixed in: 0.10.79\nSeverity: MEDIUM\nFix: Upgrade openssl to 0.10.79"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d690420ff1928069", "name": "CVE-2026-45784: openssl 0.10.75 \u2014 codex-rs/Cargo.lock", "shortDescription": {"text": "CVE-2026-45784: openssl 0.10.75 \u2014 codex-rs/Cargo.lock"}, "fullDescription": {"text": "rust-openssl provides OpenSSL bindings for the Rust programming langua ...\n\nrust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80, CipherCtxRef::cipher_update_inplace in openssl/src/cipher_ctx.rs incorrectly sized output buffers when used with AES key-wrap-with-padding ciphers EVP_aes_{128,192,256}_wrap_pad. For a non-multiple-of-8 input, OpenSSL writes up to 7 bytes past the end of the caller's buffer or Vec, producing attacker-controllable heap corruption when the plaintext length is attacker-influenced. This issue is fix\n\nPackage: openssl\nInstalled: 0.10.75\nFixed in: 0.10.80\nSeverity: MEDIUM\nFix: Upgrade openssl to 0.10.80"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-320909b867c12bd4", "name": "CVE-2026-41677: openssl 0.10.75 \u2014 codex-rs/Cargo.lock", "shortDescription": {"text": "CVE-2026-41677: openssl 0.10.75 \u2014 codex-rs/Cargo.lock"}, "fullDescription": {"text": "rust-openssl provides OpenSSL bindings for the Rust programming langua ...\n\nrust-openssl provides OpenSSL bindings for the Rust programming language.  From 0.9.0 to before 0.10.78, the *_from_pem_callback APIs did not validate the length returned by the user's callback. A password callback that returns a value larger than the buffer it was given can cause some versions of OpenSSL to over-read this buffer. OpenSSL 3.x is not affected by this. This vulnerability is fixed in 0.10.78.\n\nPackage: openssl\nInstalled: 0.10.75\nFixed in: 0.10.78\nSeverity: LOW\nFix: Upgrade openssl to 0.10.78"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-87fce9ea2110b293", "name": "CVE-2026-48504: opentelemetry_sdk 0.31.0 \u2014 codex-rs/Cargo.lock", "shortDescription": {"text": "CVE-2026-48504: opentelemetry_sdk 0.31.0 \u2014 codex-rs/Cargo.lock"}, "fullDescription": {"text": "opentelemetry_sdk has unbounded memory allocation in W3C Baggage propagation\n\nOpenTelemetry Rust is the Rust OpenTelemetry implementation. In 0.32.0 and earlier, BaggagePropagator::extract_with_context in opentelemetry_sdk did not enforce W3C Baggage size limits before parsing an inbound baggage header, so a large attacker-controlled header could cause unnecessary CPU work and short-lived heap allocations while parsing entries later discarded by the SDK's baggage storage limits. Services that accept untrusted inbound propagation headers may experience increased per-reques\n\nPackage: opentelemetry_sdk\nInstalled: 0.31.0\nFixed in: 0.32.1\nSeverity: MEDIUM\nFix: Upgrade opentelemetry_sdk to 0.32.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ccbb7902c45942e4", "name": "GHSA-3pv8-6f4r-ffg2: tar 0.4.45 \u2014 codex-rs/Cargo.lock", "shortDescription": {"text": "GHSA-3pv8-6f4r-ffg2: tar 0.4.45 \u2014 codex-rs/Cargo.lock"}, "fullDescription": {"text": "tar has a PAX header desynchronization issue\n\n### Summary\n\nWhen a tar stream contains multiple \"header\" entries prior to a file entry, tar-rs applies the PAX header (`x`) to the _next_ entry in the stream, regardless of type. For example, a stream of `x -> L -> file` (PAX, GNU longname, file) would result in `x`'s extensions being applied to `L` rather than to `file`.\n\n[Per POSIX pax](https://pubs.opengroup.org/onlinepubs/9799919799/utilities/pax.html), this is incorrect: a PAX header always applies to a file entry, not any intermediary ent\n\nPackage: tar\nInstalled: 0.4.45\nFixed in: 0.4.46\nSeverity: MEDIUM\nFix: Upgrade tar to 0.4.46"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-332497242ab356d0", "name": "CVE-2026-33055: tar 0.4.44 \u2014 tools/argument-comment-lint/Cargo.lock", "shortDescription": {"text": "CVE-2026-33055: tar 0.4.44 \u2014 tools/argument-comment-lint/Cargo.lock"}, "fullDescription": {"text": "tar-rs is a tar archive reading/writing library for Rust. Versions 0.4 ...\n\ntar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As part of CVE-2025-62518, the astral-tokio-tar project was changed to correctly honor PAX size headers in the case where it was different from the base header. This is almost the inverse of the astral-tokio-tar issue. Any discrepancy in how tar parsers honor file size can be used to create archives that appear d\n\nPackage: tar\nInstalled: 0.4.44\nFixed in: 0.4.45\nSeverity: MEDIUM\nFix: Upgrade tar to 0.4.45"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4e516440bd86adcb", "name": "CVE-2026-33056: tar 0.4.44 \u2014 tools/argument-comment-lint/Cargo.lock", "shortDescription": {"text": "CVE-2026-33056: tar 0.4.44 \u2014 tools/argument-comment-lint/Cargo.lock"}, "fullDescription": {"text": "tar-rs: tar-rs: Arbitrary directory permission modification via crafted tar archive\n\ntar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory \u2014 and subsequently apply chmod to it. This allows \n\nPackage: tar\nInstalled: 0.4.44\nFixed in: 0.4.45\nSeverity: MEDIUM\nFix: Upgrade tar to 0.4.45"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-af4eee55e877591c", "name": "GHSA-3pv8-6f4r-ffg2: tar 0.4.44 \u2014 tools/argument-comment-lint/Cargo.lock", "shortDescription": {"text": "GHSA-3pv8-6f4r-ffg2: tar 0.4.44 \u2014 tools/argument-comment-lint/Cargo.lock"}, "fullDescription": {"text": "tar has a PAX header desynchronization issue\n\n### Summary\n\nWhen a tar stream contains multiple \"header\" entries prior to a file entry, tar-rs applies the PAX header (`x`) to the _next_ entry in the stream, regardless of type. For example, a stream of `x -> L -> file` (PAX, GNU longname, file) would result in `x`'s extensions being applied to `L` rather than to `file`.\n\n[Per POSIX pax](https://pubs.opengroup.org/onlinepubs/9799919799/utilities/pax.html), this is incorrect: a PAX header always applies to a file entry, not any intermediary ent\n\nPackage: tar\nInstalled: 0.4.44\nFixed in: 0.4.46\nSeverity: MEDIUM\nFix: Upgrade tar to 0.4.46"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c9c8522741c191fe", "name": "DS-0026: No HEALTHCHECK defined \u2014 .devcontainer/Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 .devcontainer/Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: .devcontainer/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-09d170a096519c33", "name": "DS-0013: 'RUN cd ...' to change directory \u2014 .devcontainer/Dockerfile.secure", "shortDescription": {"text": "DS-0013: 'RUN cd ...' to change directory \u2014 .devcontainer/Dockerfile.secure"}, "fullDescription": {"text": "'RUN cd ...' to change directory\n\nRUN should not be used to change directory: 'curl -fsSL \"https://deb.nodesource.com/setup_${NODE_MAJOR}.x\" | bash -     && apt-get update     && apt-get install -y --no-install-recommends nodejs     && test \"$(node -p \"require('/opt/codex-install/package.json').dependencies['@openai/codex']\")\" = \"${CODEX_NPM_VERSION}\"     && cd /opt/codex-install     && corepack pnpm install --prod --frozen-lockfile     && ln -s /opt/codex-install/node_modules/.bin/codex /usr/local/bin/codex     && apt-get clean\n\nRule: DS-0013\nSeverity: MEDIUM\nTarget: .devcontainer/Dockerfile.secure"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8c09d3f33cb5da6d", "name": "DS-0026: No HEALTHCHECK defined \u2014 .devcontainer/Dockerfile.secure", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 .devcontainer/Dockerfile.secure"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: .devcontainer/Dockerfile.secure"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-84bfcdf82eccd306", "name": "DS-0026: No HEALTHCHECK defined \u2014 .github/workflows/Dockerfile.bazel", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 .github/workflows/Dockerfile.bazel"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: .github/workflows/Dockerfile.bazel"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d63fb340484c2d1a", "name": "Secret leak: Asymmetric Private Key \u2014 codex-rs/agent-identity/src/lib.rs", "shortDescription": {"text": "Secret leak: Asymmetric Private Key \u2014 codex-rs/agent-identity/src/lib.rs"}, "fullDescription": {"text": "Trivy detected a possible secret in `codex-rs/agent-identity/src/lib.rs`.\n\nRule: private-key\nSeverity: HIGH\nMatch (redacted): ****************************************************************\n\nAction: rotate the credential and remove it from the repo. Use a secrets manager or environment variables."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7cbbfa9a29b9d957", "name": "Secret leak: Asymmetric Private Key \u2014 codex-rs/login/src/auth/agent_identity.rs", "shortDescription": {"text": "Secret leak: Asymmetric Private Key \u2014 codex-rs/login/src/auth/agent_identity.rs"}, "fullDescription": {"text": "Trivy detected a possible secret in `codex-rs/login/src/auth/agent_identity.rs`.\n\nRule: private-key\nSeverity: HIGH\nMatch (redacted): ****************************************************************\n\nAction: rotate the credential and remove it from the repo. Use a secrets manager or environment variables."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-70529cc568f8adfb", "name": "Secret leak: JWT token \u2014 codex-rs/model-provider/src/auth.rs", "shortDescription": {"text": "Secret leak: JWT token \u2014 codex-rs/model-provider/src/auth.rs"}, "fullDescription": {"text": "Trivy detected a possible secret in `codex-rs/model-provider/src/auth.rs`.\n\nRule: jwt-token\nSeverity: MEDIUM\nMatch (redacted): EST_CHATGPT_ID_TOKEN: &str = \"**************************************************\n\nAction: rotate the credential and remove it from the repo. Use a secrets manager or environment variables."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2679282aa1c484b5", "name": "Agent authority lacks a verifier contract: AGENTS.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2505e6df3ecf5685", "name": "Agent authority lacks a verifier contract: codex-rs/skills/src/assets/samples/skill-installer/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: codex-rs/skills/src/assets/samples/skill-installer/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9ba50bada784e634", "name": "Agent authority lacks a verifier contract: codex-rs/skills/src/assets/samples/plugin-creator/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: codex-rs/skills/src/assets/samples/plugin-creator/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fb84f7ef946bd038", "name": "Agent instruction contains unpinned remote install: codex-rs/skills/src/assets/samples/qa-testing/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: codex-rs/skills/src/assets/samples/qa-testing/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2de8c44bf3a0cfd1", "name": "Agent authority lacks a verifier contract: .codex/skills/path-types/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .codex/skills/path-types/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3595efb04a9f8c61", "name": "Agent authority lacks a verifier contract: .codex/skills/update-v8-version/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .codex/skills/update-v8-version/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-89692a10129d6f76", "name": "Agent authority lacks a verifier contract: .codex/skills/code-review/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .codex/skills/code-review/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6c7aaf7634412ce6", "name": "Agent authority lacks a verifier contract: .codex/skills/codex-issue-digest/agents/openai.yaml", "shortDescription": {"text": "Agent authority lacks a verifier contract: .codex/skills/codex-issue-digest/agents/openai.yaml"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b2d2f1f893884742", "name": "Agent authority lacks a verifier contract: .codex/skills/remote-tests/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .codex/skills/remote-tests/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-83ca04991b5ad924", "name": "Agent authority lacks a verifier contract: .codex/skills/babysit-pr/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .codex/skills/babysit-pr/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0d3263600289612c", "name": "Agent authority lacks a verifier contract: .codex/skills/babysit-pr/references/github-api-notes.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .codex/skills/babysit-pr/references/github-api-notes.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-05a0a8919130060d", "name": "Agent authority lacks a verifier contract: .codex/skills/babysit-pr/references/heuristics.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .codex/skills/babysit-pr/references/heuristics.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a5758914f9faf4ef", "name": "Agent authority lacks a verifier contract: .codex/skills/babysit-pr/agents/openai.yaml", "shortDescription": {"text": "Agent authority lacks a verifier contract: .codex/skills/babysit-pr/agents/openai.yaml"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4a952517d41609e2", "name": "Agent authority lacks a verifier contract: .codex/skills/codex-pr-body/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .codex/skills/codex-pr-body/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-06809e2945cfabfa", "name": "SkillSpector AST4 (behavioral-ast) in .codex/skills/babysit-pr/scripts/gh_pr_watch.py", "shortDescription": {"text": "SkillSpector AST4 (behavioral-ast) in .codex/skills/babysit-pr/scripts/gh_pr_watch.py"}, "fullDescription": {"text": "proc = subprocess.run(cmd, check=True, capture_output=True, text=True)\n\nsubprocess module calls execute external commands. Without careful input validation, this enables command injection.\n\nSkill: babysit-pr\nRule: AST4  Category: behavioral-ast\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Use subprocess.run() with shell=False and an explicit argument list. Validate all inputs and avoid passing user-controlled data to commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-2b55920732728d2b", "name": "SkillSpector LP3 (mcp-least-priv) in .codex/skills/babysit-pr/SKILL.md", "shortDescription": {"text": "SkillSpector LP3 (mcp-least-priv) in .codex/skills/babysit-pr/SKILL.md"}, "fullDescription": {"text": "MCP Least Privilege\n\nWithout declared permissions the skill's intent is opaque and cannot be validated.\n\nSkill: babysit-pr\nRule: LP3  Category: mcp-least-priv\nSeverity: MEDIUM  Confidence: 0.70\n\nRemediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requires."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-5ee482f6edf4ae27", "name": "SkillSpector EA2 (excessive-agency) in .codex/skills/babysit-pr/SKILL.md", "shortDescription": {"text": "SkillSpector EA2 (excessive-agency) in .codex/skills/babysit-pr/SKILL.md"}, "fullDescription": {"text": "without asking\n\nSkill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.\n\nSkill: babysit-pr\nRule: EA2  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.75\n\nRemediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.75}}, {"id": "scanner-e47adc07c9ff2fe1", "name": "SkillSpector OH1 (output-handling) in .codex/skills/babysit-pr/scripts/gh_pr_watch.py", "shortDescription": {"text": "SkillSpector OH1 (output-handling) in .codex/skills/babysit-pr/scripts/gh_pr_watch.py"}, "fullDescription": {"text": "subprocess.run(cmd, check=True, capture_output\n\nModel output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.\n\nSkill: babysit-pr\nRule: OH1  Category: output-handling\nSeverity: HIGH  Confidence: 0.95\n\nRemediation: Validate and sanitize all model output before using it in downstream contexts. Use parameterized queries for SQL, shell quoting for commands, and HTML encoding for web output."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.95}}, {"id": "scanner-b05550a98880ac53", "name": "SkillSpector E1 (data-exfil) in .codex/skills/codex-bug/SKILL.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in .codex/skills/codex-bug/SKILL.md"}, "fullDescription": {"text": "https://api.github.com/\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: codex-bug\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.50\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.5}}, {"id": "scanner-d509a817ba1cff0e", "name": "SkillSpector AST4 (behavioral-ast) in .codex/skills/codex-issue-digest/scripts/collect_issue_digest.py", "shortDescription": {"text": "SkillSpector AST4 (behavioral-ast) in .codex/skills/codex-issue-digest/scripts/collect_issue_digest.py"}, "fullDescription": {"text": "proc = subprocess.run(cmd, check=True, capture_output=True, text=True)\n\nsubprocess module calls execute external commands. Without careful input validation, this enables command injection.\n\nSkill: codex-issue-digest\nRule: AST4  Category: behavioral-ast\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Use subprocess.run() with shell=False and an explicit argument list. Validate all inputs and avoid passing user-controlled data to commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-6366747dc41e032b", "name": "SkillSpector LP3 (mcp-least-priv) in .codex/skills/codex-issue-digest/SKILL.md", "shortDescription": {"text": "SkillSpector LP3 (mcp-least-priv) in .codex/skills/codex-issue-digest/SKILL.md"}, "fullDescription": {"text": "MCP Least Privilege\n\nWithout declared permissions the skill's intent is opaque and cannot be validated.\n\nSkill: codex-issue-digest\nRule: LP3  Category: mcp-least-priv\nSeverity: MEDIUM  Confidence: 0.70\n\nRemediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requires."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-31126f9ae289e9e7", "name": "SkillSpector OH1 (output-handling) in .codex/skills/codex-issue-digest/scripts/collect_issue_digest.py", "shortDescription": {"text": "SkillSpector OH1 (output-handling) in .codex/skills/codex-issue-digest/scripts/collect_issue_digest.py"}, "fullDescription": {"text": "subprocess.run(cmd, check=True, capture_output\n\nModel output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.\n\nSkill: codex-issue-digest\nRule: OH1  Category: output-handling\nSeverity: HIGH  Confidence: 0.95\n\nRemediation: Validate and sanitize all model output before using it in downstream contexts. Use parameterized queries for SQL, shell quoting for commands, and HTML encoding for web output."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.95}}, {"id": "scanner-94dcca14283e2b12", "name": "SkillSpector EA3 (excessive-agency) in .codex/skills/codex-pr-body/SKILL.md", "shortDescription": {"text": "SkillSpector EA3 (excessive-agency) in .codex/skills/codex-pr-body/SKILL.md"}, "fullDescription": {"text": "not limited to\n\nSkill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.\n\nSkill: codex-pr-body\nRule: EA3  Category: excessive-agency\nSeverity: LOW  Confidence: 0.70\n\nRemediation: Limit the skill's scope to its documented purpose. Remove instructions that enable the agent to perform actions outside its stated functionality."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.7}}, {"id": "scanner-0491596da465f16a", "name": "SkillSpector AST7 (behavioral-ast) in codex-rs/skills/src/assets/samples/imagegen/scripts/image_gen.py", "shortDescription": {"text": "SkillSpector AST7 (behavioral-ast) in codex-rs/skills/src/assets/samples/imagegen/scripts/image_gen.py"}, "fullDescription": {"text": "val = getattr(exc, attr, None)\n\nDynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.\n\nSkill: imagegen\nRule: AST7  Category: behavioral-ast\nSeverity: LOW  Confidence: 0.50\n\nRemediation: Replace dynamic getattr() with explicit attribute access or a dictionary lookup with an allowlist of permitted attributes."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.5}}, {"id": "scanner-f49129265480f064", "name": "SkillSpector LP3 (mcp-least-priv) in codex-rs/skills/src/assets/samples/imagegen/SKILL.md", "shortDescription": {"text": "SkillSpector LP3 (mcp-least-priv) in codex-rs/skills/src/assets/samples/imagegen/SKILL.md"}, "fullDescription": {"text": "MCP Least Privilege\n\nWithout declared permissions the skill's intent is opaque and cannot be validated.\n\nSkill: imagegen\nRule: LP3  Category: mcp-least-priv\nSeverity: MEDIUM  Confidence: 0.70\n\nRemediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requires."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-e4a6b8720bdf5b63", "name": "SkillSpector EA3 (excessive-agency) in codex-rs/skills/src/assets/samples/imagegen/LICENSE.txt", "shortDescription": {"text": "SkillSpector EA3 (excessive-agency) in codex-rs/skills/src/assets/samples/imagegen/LICENSE.txt"}, "fullDescription": {"text": "not limited to\n\nSkill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.\n\nSkill: imagegen\nRule: EA3  Category: excessive-agency\nSeverity: LOW  Confidence: 0.70\n\nRemediation: Limit the skill's scope to its documented purpose. Remove instructions that enable the agent to perform actions outside its stated functionality."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.7}}, {"id": "scanner-91d77a4cd5f42dcf", "name": "SkillSpector EA2 (excessive-agency) in codex-rs/skills/src/assets/samples/imagegen/SKILL.md", "shortDescription": {"text": "SkillSpector EA2 (excessive-agency) in codex-rs/skills/src/assets/samples/imagegen/SKILL.md"}, "fullDescription": {"text": "Do not ask the user\n\nSkill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.\n\nSkill: imagegen\nRule: EA2  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.80\n\nRemediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-656c2f67d22f8e30", "name": "SkillSpector P6 (prompt-injection) in codex-rs/skills/src/assets/samples/imagegen/scripts/image_gen.py", "shortDescription": {"text": "SkillSpector P6 (prompt-injection) in codex-rs/skills/src/assets/samples/imagegen/scripts/image_gen.py"}, "fullDescription": {"text": "return prompt\n\nSkill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.\n\nSkill: imagegen\nRule: P6  Category: prompt-injection\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Remove any instructions that reveal, print, or output system prompts or internal rules. System instructions should never be exposed to end users."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-13ac325451042f5c", "name": "SkillSpector TM1 (tool-misuse) in codex-rs/skills/src/assets/samples/imagegen/references/cli.md", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in codex-rs/skills/src/assets/samples/imagegen/references/cli.md"}, "fullDescription": {"text": "rm -f tmp/imagegen/\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: imagegen\nRule: TM1  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-abac3407d2f4a71a", "name": "SkillSpector LP3 (mcp-least-priv) in codex-rs/skills/src/assets/samples/openai-docs/SKILL.md", "shortDescription": {"text": "SkillSpector LP3 (mcp-least-priv) in codex-rs/skills/src/assets/samples/openai-docs/SKILL.md"}, "fullDescription": {"text": "MCP Least Privilege\n\nWithout declared permissions the skill's intent is opaque and cannot be validated.\n\nSkill: openai-docs\nRule: LP3  Category: mcp-least-priv\nSeverity: MEDIUM  Confidence: 0.70\n\nRemediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requires."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-9f69b3f6204e4734", "name": "SkillSpector EA3 (excessive-agency) in codex-rs/skills/src/assets/samples/openai-docs/LICENSE.txt", "shortDescription": {"text": "SkillSpector EA3 (excessive-agency) in codex-rs/skills/src/assets/samples/openai-docs/LICENSE.txt"}, "fullDescription": {"text": "not limited to\n\nSkill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.\n\nSkill: openai-docs\nRule: EA3  Category: excessive-agency\nSeverity: LOW  Confidence: 0.70\n\nRemediation: Limit the skill's scope to its documented purpose. Remove instructions that enable the agent to perform actions outside its stated functionality."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.7}}, {"id": "scanner-bfc27b798ae0bd53", "name": "SkillSpector P6 (prompt-injection) in codex-rs/skills/src/assets/samples/openai-docs/references/upgrade-guide.md", "shortDescription": {"text": "SkillSpector P6 (prompt-injection) in codex-rs/skills/src/assets/samples/openai-docs/references/upgrade-guide.md"}, "fullDescription": {"text": "Output rule\n\nSkill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.\n\nSkill: openai-docs\nRule: P6  Category: prompt-injection\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Remove any instructions that reveal, print, or output system prompts or internal rules. System instructions should never be exposed to end users."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-0b8c52f0e72fc361", "name": "SkillSpector LP3 (mcp-least-priv) in codex-rs/skills/src/assets/samples/plugin-creator/SKILL.md", "shortDescription": {"text": "SkillSpector LP3 (mcp-least-priv) in codex-rs/skills/src/assets/samples/plugin-creator/SKILL.md"}, "fullDescription": {"text": "MCP Least Privilege\n\nWithout declared permissions the skill's intent is opaque and cannot be validated.\n\nSkill: plugin-creator\nRule: LP3  Category: mcp-least-priv\nSeverity: MEDIUM  Confidence: 0.70\n\nRemediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requires."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-8ebedfad5a119bfa", "name": "SkillSpector RA2 (rogue-agent) in codex-rs/skills/src/assets/samples/plugin-creator/SKILL.md", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in codex-rs/skills/src/assets/samples/plugin-creator/SKILL.md"}, "fullDescription": {"text": "Create and scaffold plugin directories for Codex with a required `.codex-plugin/plugin.json`, optional plugin folders/files, valid manifest defaults, and personal-marketplace entries by default. Use w\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: plugin-creator\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-c01b655d87c362a0", "name": "SkillSpector RA1 (rogue-agent) in codex-rs/skills/src/assets/samples/plugin-creator/references/installing-and-updating.m", "shortDescription": {"text": "SkillSpector RA1 (rogue-agent) in codex-rs/skills/src/assets/samples/plugin-creator/references/installing-and-updating.md"}, "fullDescription": {"text": "Replace the existing Code\n\nSkill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.\n\nSkill: plugin-creator\nRule: RA1  Category: rogue-agent\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-14b14cd4e0f3ecf0", "name": "SkillSpector RA2 (rogue-agent) in codex-rs/skills/src/assets/samples/plugin-creator/references/plugin-json-spec.md", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in codex-rs/skills/src/assets/samples/plugin-creator/references/plugin-json-spec.md"}, "fullDescription": {"text": "write is intentional.\n- Default new plugin creation to the personal marketplace.\n- Use a repo/team marketplace only when the user specifically requests that destination.\n- Only override the marketplac\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: plugin-creator\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-c276fe422266f9c1", "name": "SkillSpector RA1 (rogue-agent) in codex-rs/skills/src/assets/samples/plugin-creator/scripts/create_basic_plugin.py", "shortDescription": {"text": "SkillSpector RA1 (rogue-agent) in codex-rs/skills/src/assets/samples/plugin-creator/scripts/create_basic_plugin.py"}, "fullDescription": {"text": "Overwrite existing file\n\nSkill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.\n\nSkill: plugin-creator\nRule: RA1  Category: rogue-agent\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-bdfb61d2f29d1cd7", "name": "SkillSpector RA2 (rogue-agent) in codex-rs/skills/src/assets/samples/qa-testing/SKILL.md", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in codex-rs/skills/src/assets/samples/qa-testing/SKILL.md"}, "fullDescription": {"text": "mkdir -p ~/.local/bin\n  curl -fL \"https://github.com/vercel-labs/agent-browser/releases/latest/download/$asset\" -o ~/.local/bin/agent-browser\n  chmod +x ~/.local\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: qa-testing\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-879419c26e25e1ff", "name": "SkillSpector LP3 (mcp-least-priv) in codex-rs/skills/src/assets/samples/skill-creator/SKILL.md", "shortDescription": {"text": "SkillSpector LP3 (mcp-least-priv) in codex-rs/skills/src/assets/samples/skill-creator/SKILL.md"}, "fullDescription": {"text": "MCP Least Privilege\n\nWithout declared permissions the skill's intent is opaque and cannot be validated.\n\nSkill: skill-creator\nRule: LP3  Category: mcp-least-priv\nSeverity: MEDIUM  Confidence: 0.70\n\nRemediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requires."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-0ae4dcc70aeccaaa", "name": "SkillSpector E1 (data-exfil) in codex-rs/skills/src/assets/samples/skill-creator/references/openai_yaml.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in codex-rs/skills/src/assets/samples/skill-creator/references/openai_yaml.md"}, "fullDescription": {"text": "https://api.githubcopilot.com/\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: skill-creator\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.50\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.5}}, {"id": "scanner-0556c93948bd0c0e", "name": "SkillSpector EA3 (excessive-agency) in codex-rs/skills/src/assets/samples/skill-creator/license.txt", "shortDescription": {"text": "SkillSpector EA3 (excessive-agency) in codex-rs/skills/src/assets/samples/skill-creator/license.txt"}, "fullDescription": {"text": "not limited to\n\nSkill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.\n\nSkill: skill-creator\nRule: EA3  Category: excessive-agency\nSeverity: LOW  Confidence: 0.70\n\nRemediation: Limit the skill's scope to its documented purpose. Remove instructions that enable the agent to perform actions outside its stated functionality."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.7}}, {"id": "scanner-a8e837fd760b4f28", "name": "SkillSpector RA1 (rogue-agent) in codex-rs/skills/src/assets/samples/skill-creator/SKILL.md", "shortDescription": {"text": "SkillSpector RA1 (rogue-agent) in codex-rs/skills/src/assets/samples/skill-creator/SKILL.md"}, "fullDescription": {"text": "write SKILL\n\nSkill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.\n\nSkill: skill-creator\nRule: RA1  Category: rogue-agent\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-36b67c1580a81a30", "name": "SkillSpector RA2 (rogue-agent) in codex-rs/skills/src/assets/samples/skill-creator/SKILL.md", "shortDescription": {"text": "SkillSpector RA2 (rogue-agent) in codex-rs/skills/src/assets/samples/skill-creator/SKILL.md"}, "fullDescription": {"text": "create a new skill (or update an existing skill) that extends Codex's capabilities with specialized knowledge, workflows, or tool integrations.\nmetadata:\n  short-description: Create or update a skill\n\nSkill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.\n\nSkill: skill-creator\nRule: RA2  Category: rogue-agent\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-bf19e46d4c4ddfd7", "name": "SkillSpector RA1 (rogue-agent) in codex-rs/skills/src/assets/samples/skill-creator/scripts/init_skill.py", "shortDescription": {"text": "SkillSpector RA1 (rogue-agent) in codex-rs/skills/src/assets/samples/skill-creator/scripts/init_skill.py"}, "fullDescription": {"text": "Edit SKILL\n\nSkill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.\n\nSkill: skill-creator\nRule: RA1  Category: rogue-agent\nSeverity: HIGH  Confidence: 0.85\n\nRemediation: Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.85}}, {"id": "scanner-98b350008d03938e", "name": "SkillSpector AST4 (behavioral-ast) in codex-rs/skills/src/assets/samples/skill-installer/scripts/install-skill-from-gith", "shortDescription": {"text": "SkillSpector AST4 (behavioral-ast) in codex-rs/skills/src/assets/samples/skill-installer/scripts/install-skill-from-github.py"}, "fullDescription": {"text": "result = subprocess.run(args, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)\n\nsubprocess module calls execute external commands. Without careful input validation, this enables command injection.\n\nSkill: skill-installer\nRule: AST4  Category: behavioral-ast\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Use subprocess.run() with shell=False and an explicit argument list. Validate all inputs and avoid passing user-controlled data to commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-79faa5c273f0075c", "name": "SkillSpector LP3 (mcp-least-priv) in codex-rs/skills/src/assets/samples/skill-installer/SKILL.md", "shortDescription": {"text": "SkillSpector LP3 (mcp-least-priv) in codex-rs/skills/src/assets/samples/skill-installer/SKILL.md"}, "fullDescription": {"text": "MCP Least Privilege\n\nWithout declared permissions the skill's intent is opaque and cannot be validated.\n\nSkill: skill-installer\nRule: LP3  Category: mcp-least-priv\nSeverity: MEDIUM  Confidence: 0.70\n\nRemediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requires."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-83ac2428a9e0c225", "name": "SkillSpector E1 (data-exfil) in codex-rs/skills/src/assets/samples/skill-installer/scripts/github_utils.py", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in codex-rs/skills/src/assets/samples/skill-installer/scripts/github_utils.py"}, "fullDescription": {"text": "https://api.github.com/\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: skill-installer\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-4d59c3c308bdf412", "name": "SkillSpector E2 (data-exfil) in codex-rs/skills/src/assets/samples/skill-installer/scripts/github_utils.py", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in codex-rs/skills/src/assets/samples/skill-installer/scripts/github_utils.py"}, "fullDescription": {"text": "os.environ.get(\"GITHUB_TOKEN\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: skill-installer\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.70\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.7}}, {"id": "scanner-7c1ab73c2f9941da", "name": "SkillSpector EA3 (excessive-agency) in codex-rs/skills/src/assets/samples/skill-installer/LICENSE.txt", "shortDescription": {"text": "SkillSpector EA3 (excessive-agency) in codex-rs/skills/src/assets/samples/skill-installer/LICENSE.txt"}, "fullDescription": {"text": "not limited to\n\nSkill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.\n\nSkill: skill-installer\nRule: EA3  Category: excessive-agency\nSeverity: LOW  Confidence: 0.70\n\nRemediation: Limit the skill's scope to its documented purpose. Remove instructions that enable the agent to perform actions outside its stated functionality."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.7}}, {"id": "scanner-e637c415447867e4", "name": "Run SkillSpector's LLM-backed analysis in your own pipeline", "shortDescription": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "fullDescription": {"text": "Repobility ran SkillSpector's static rules server-side. The deeper LLM-backed analyzers \u2014 tool-poisoning (TP*), semantic security discovery (SSD*), developer-intent mismatch (SDI*) \u2014 are meant to run on YOUR machine with YOUR model; repobility never sends your code to an LLM. Recipe:\n\n# 1. Install SkillSpector in your own isolated env\npipx install \"skillspector @ git+https://github.com/NVIDIA/SkillSpector.git\"\n\n# 2. Point it at YOUR LLM pipeline (pick one) - your code stays on your machine\nexport SKILLSPECTOR_PROVIDER=anthropic && export ANTHROPIC_API_KEY=sk-ant-...\n# export SKILLSPECTOR_PROVIDER=openai   && export OPENAI_API_KEY=sk-...\n# export SKILLSPECTOR_PROVIDER=openai OPENAI_API_KEY=ollama OPENAI_BASE_URL=http://localhost:11434/v1 SKILLSPECTOR_MODEL=llama3.1:8b\n# export SKILLSPECTOR_PROVIDER=nv_build && export NVIDIA_INFERENCE_KEY=nvapi-...\n\n# 3. Run the LLM-backed scan per skill (omit --no-llm to enable the LLM analyzers)\nskillspector scan .codex/skills/babysit-pr --format sarif"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "info", "confidence": 1.0}}, {"id": "scanner-840da370e9e2f1b4", "name": "Docker base image is tag-pinned but not digest-pinned: ubuntu:24.04", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: ubuntu:24.04"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-42222223b4a3450e", "name": "Dockerfile pipes a remote installer into a shell", "shortDescription": {"text": "Dockerfile pipes a remote installer into a shell"}, "fullDescription": {"text": "Executing downloaded code during image build gives the remote endpoint build-time code execution. Prefer pinned packages or verify downloaded installers by checksum/signature."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "high", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2438b6d759fe57fe", "name": "Possible secret in codex-rs/login/src/auth/bedrock_api_key_tests.rs", "shortDescription": {"text": "Possible secret in codex-rs/login/src/auth/bedrock_api_key_tests.rs"}, "fullDescription": {"text": "Detected 1 occurrence(s) matching generic_api_key. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.72}}, {"id": "scanner-75d8946ec4330ae5", "name": "Possible secret in codex-rs/model-provider/src/auth.rs", "shortDescription": {"text": "Possible secret in codex-rs/model-provider/src/auth.rs"}, "fullDescription": {"text": "Detected 1 occurrence(s) matching generic_api_key. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.72}}, {"id": "scanner-59688bbaba0fddd4", "name": "Possible secret in codex-rs/model-provider/src/provider.rs", "shortDescription": {"text": "Possible secret in codex-rs/model-provider/src/provider.rs"}, "fullDescription": {"text": "Detected 1 occurrence(s) matching generic_api_key. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.72}}, {"id": "scanner-b293927949628d80", "name": "Possible secret in codex-rs/model-provider/src/amazon_bedrock/mod.rs", "shortDescription": {"text": "Possible secret in codex-rs/model-provider/src/amazon_bedrock/mod.rs"}, "fullDescription": {"text": "Detected 1 occurrence(s) matching generic_api_key. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.72}}, {"id": "scanner-c85fe51e21163e5c", "name": "Insecure pattern 'exec_used' in codex-rs/core/src/exec.rs:534", "shortDescription": {"text": "Insecure pattern 'exec_used' in codex-rs/core/src/exec.rs:534"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-629fce79f9e3c389", "name": "Possible secret in codex-rs/network-proxy/src/credential_broker_tests.rs", "shortDescription": {"text": "Possible secret in codex-rs/network-proxy/src/credential_broker_tests.rs"}, "fullDescription": {"text": "Detected 1 occurrence(s) matching github_token. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 0.99}}, {"id": "scanner-c2c0ceb01b8d3fda", "name": "Possible secret in codex-rs/network-proxy/src/credential_broker_tests.rs", "shortDescription": {"text": "Possible secret in codex-rs/network-proxy/src/credential_broker_tests.rs"}, "fullDescription": {"text": "Detected 1 occurrence(s) matching generic_api_key. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.72}}, {"id": "scanner-91365f42cbf98805", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-33eb15dac68c8444", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d746558daab2a5bb", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-05ddeaa1c2f3b7bf", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f3ea3764a6611f52", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3eddcf26b2d6baf1", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ca1eab671c04e8e6", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d3bb24d9d2019e82", "name": "Very large file: codex-rs/cloud-tasks/src/lib.rs (2402 lines)", "shortDescription": {"text": "Very large file: codex-rs/cloud-tasks/src/lib.rs (2402 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-392c4bbfb73994ee", "name": "Very large file: codex-rs/exec-server/src/relay.rs (1318 lines)", "shortDescription": {"text": "Very large file: codex-rs/exec-server/src/relay.rs (1318 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bc7612bae6e0234d", "name": "Very large file: codex-rs/exec-server/src/client.rs (2444 lines)", "shortDescription": {"text": "Very large file: codex-rs/exec-server/src/client.rs (2444 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d554cf7ba37c4025", "name": "Very large file: codex-rs/state/src/runtime/goals.rs (1639 lines)", "shortDescription": {"text": "Very large file: codex-rs/state/src/runtime/goals.rs (1639 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3e09786d2f775ff0", "name": "Very large file: codex-rs/state/src/runtime/threads.rs (3083 lines)", "shortDescription": {"text": "Very large file: codex-rs/state/src/runtime/threads.rs (3083 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-719d260dcc68b196", "name": "Very large file: codex-rs/state/src/runtime/logs.rs (1859 lines)", "shortDescription": {"text": "Very large file: codex-rs/state/src/runtime/logs.rs (1859 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5c16a209da132e28", "name": "Very large file: codex-rs/state/src/runtime/memories.rs (5290 lines)", "shortDescription": {"text": "Very large file: codex-rs/state/src/runtime/memories.rs (5290 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1f9e977bd61c127f", "name": "Very large file: codex-rs/config/src/config_requirements.rs (3843 lines)", "shortDescription": {"text": "Very large file: codex-rs/config/src/config_requirements.rs (3843 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9b6f99659d1ef43", "name": "Very large file: codex-rs/config/src/loader/mod.rs (1570 lines)", "shortDescription": {"text": "Very large file: codex-rs/config/src/loader/mod.rs (1570 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-68ac946a4bfc355d", "name": "Very large file: codex-rs/analytics/src/reducer.rs (2840 lines)", "shortDescription": {"text": "Very large file: codex-rs/analytics/src/reducer.rs (2840 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-043bc63da96b5ba0", "name": "Very large file: codex-rs/analytics/src/analytics_client_tests.rs (4810 lines)", "shortDescription": {"text": "Very large file: codex-rs/analytics/src/analytics_client_tests.rs (4810 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5ed821b31f45ee1b", "name": "Very large file: codex-rs/acp-server/src/lib.rs (1367 lines)", "shortDescription": {"text": "Very large file: codex-rs/acp-server/src/lib.rs (1367 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1eb4a73fd2d81ea7", "name": "Very large file: codex-rs/tui/src/keymap_setup.rs (1932 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/keymap_setup.rs (1932 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-38ce50f15c82365a", "name": "Very large file: codex-rs/tui/src/lib.rs (3098 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/lib.rs (3098 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a57fa47c1d7b42c3", "name": "Very large file: codex-rs/tui/src/app_server_session.rs (2762 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/app_server_session.rs (2762 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-04fa3b5e7c94e47c", "name": "Very large file: codex-rs/tui/src/chatwidget.rs (2081 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/chatwidget.rs (2081 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-80d149e5e896563c", "name": "Very large file: codex-rs/tui/src/diff_render.rs (2534 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/diff_render.rs (2534 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-32b46f9060876162", "name": "Very large file: codex-rs/tui/src/markdown_render.rs (2774 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/markdown_render.rs (2774 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-63bb2ac7bf736fc1", "name": "Very large file: codex-rs/tui/src/markdown_render_tests.rs (1827 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/markdown_render_tests.rs (1827 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9f3abbf0d166771c", "name": "Very large file: codex-rs/tui/src/keymap.rs (2980 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/keymap.rs (2980 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1c9c0c8963768d24", "name": "Very large file: codex-rs/tui/src/wrapping.rs (1657 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/wrapping.rs (1657 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-abbb72a38bb05d1f", "name": "Very large file: codex-rs/tui/src/app.rs (1390 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/app.rs (1390 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-faa0c8efb7f43836", "name": "Very large file: codex-rs/tui/src/pager_overlay.rs (1570 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/pager_overlay.rs (1570 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f4e33dbbad8b21b7", "name": "Very large file: codex-rs/tui/src/resume_picker.rs (6351 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/resume_picker.rs (6351 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2bf28d45323eb4c5", "name": "Very large file: codex-rs/tui/src/bottom_pane/mcp_server_elicitation.rs (2732 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/bottom_pane/mcp_server_elicitation.rs (2732 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c9722a173a73eda", "name": "Very large file: codex-rs/tui/src/bottom_pane/app_link_view.rs (1704 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/bottom_pane/app_link_view.rs (1704 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-25b0ebbf95081c2a", "name": "Very large file: codex-rs/tui/src/bottom_pane/textarea.rs (3837 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/bottom_pane/textarea.rs (3837 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3fb759d81fe6783b", "name": "Very large file: codex-rs/tui/src/bottom_pane/approval_overlay.rs (2409 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/bottom_pane/approval_overlay.rs (2409 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4d115e50dfc21a87", "name": "Very large file: codex-rs/tui/src/bottom_pane/hooks_browser_view.rs (1634 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/bottom_pane/hooks_browser_view.rs (1634 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f93c405021855d2d", "name": "Very large file: codex-rs/tui/src/bottom_pane/mod.rs (3078 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/bottom_pane/mod.rs (3078 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2f3d8b6d9323f309", "name": "Very large file: codex-rs/tui/src/bottom_pane/chat_composer.rs (11501 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/bottom_pane/chat_composer.rs (11501 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-af9c6d36f047cef3", "name": "Very large file: codex-rs/tui/src/bottom_pane/chat_composer_history.rs (1505 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/bottom_pane/chat_composer_history.rs (1505 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-af35014efdc0c376", "name": "Very large file: codex-rs/tui/src/bottom_pane/footer.rs (2077 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/bottom_pane/footer.rs (2077 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-68b71a9ce6340e84", "name": "Very large file: codex-rs/tui/src/bottom_pane/list_selection_view.rs (2840 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/bottom_pane/list_selection_view.rs (2840 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e65e2d89f9e51868", "name": "Very large file: codex-rs/tui/src/bottom_pane/request_user_input/mod.rs (3755 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/bottom_pane/request_user_input/mod.rs (3755 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-851fb0e826a3b22b", "name": "Very large file: codex-rs/tui/src/history_cell/tests.rs (2738 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/history_cell/tests.rs (2738 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c93f50787aa076a9", "name": "Very large file: codex-rs/tui/src/chatwidget/plugin_catalog.rs (2065 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/chatwidget/plugin_catalog.rs (2065 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aba2b59793727ff0", "name": "Very large file: codex-rs/tui/src/chatwidget/model_popups.rs (1370 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/chatwidget/model_popups.rs (1370 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5bb37db5f25719ce", "name": "Very large file: codex-rs/tui/src/chatwidget/tests/status_and_layout.rs (4200 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/chatwidget/tests/status_and_layout.rs (4200 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-afe68eb9728bf154", "name": "Very large file: codex-rs/tui/src/chatwidget/tests/composer_submission.rs (1499 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/chatwidget/tests/composer_submission.rs (1499 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-44f319da860383e9", "name": "Very large file: codex-rs/tui/src/chatwidget/tests/slash_commands.rs (3021 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/chatwidget/tests/slash_commands.rs (3021 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eb47fa22282a9ee4", "name": "Very large file: codex-rs/tui/src/chatwidget/tests/popups_and_settings.rs (3881 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/chatwidget/tests/popups_and_settings.rs (3881 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bdbc9c103a53fbed", "name": "Very large file: codex-rs/tui/src/chatwidget/tests/exec_flow.rs (1748 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/chatwidget/tests/exec_flow.rs (1748 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-82af0770431a4826", "name": "Very large file: codex-rs/tui/src/chatwidget/tests/helpers.rs (1691 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/chatwidget/tests/helpers.rs (1691 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-89b7fb10eca02c43", "name": "Very large file: codex-rs/tui/src/chatwidget/tests/plan_mode.rs (1708 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/chatwidget/tests/plan_mode.rs (1708 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-96b95fba5a031431", "name": "Very large file: codex-rs/tui/src/chatwidget/tests/review_mode.rs (1477 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/chatwidget/tests/review_mode.rs (1477 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-100ad1f188f0f8dc", "name": "Very large file: codex-rs/tui/src/app/event_dispatch.rs (2816 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/app/event_dispatch.rs (2816 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fdaab5eaf298412c", "name": "Very large file: codex-rs/tui/src/app/config_persistence.rs (1743 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/app/config_persistence.rs (1743 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fbc23b73bb913655", "name": "Very large file: codex-rs/tui/src/app/background_requests.rs (1552 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/app/background_requests.rs (1552 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0e23737a7395ebe6", "name": "Very large file: codex-rs/tui/src/app/tests.rs (6277 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/app/tests.rs (6277 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3063a856878e80bb", "name": "Very large file: codex-rs/tui/src/app/thread_routing.rs (1655 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/app/thread_routing.rs (1655 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-61cdc7094b5b59a6", "name": "Very large file: codex-rs/tui/src/status/tests.rs (2038 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/status/tests.rs (2038 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dce468a5210cd710", "name": "Very large file: codex-rs/tui/src/onboarding/auth.rs (1410 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/onboarding/auth.rs (1410 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aac120c7430f7903", "name": "Very large file: codex-rs/tui/src/streaming/controller.rs (1922 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/streaming/controller.rs (1922 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5029e9eddb7a7d5a", "name": "Very large file: codex-rs/tui/src/render/highlight.rs (1567 lines)", "shortDescription": {"text": "Very large file: codex-rs/tui/src/render/highlight.rs (1567 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c1413bc08f5cd1cf", "name": "Very large file: codex-rs/login/src/auth/manager.rs (2622 lines)", "shortDescription": {"text": "Very large file: codex-rs/login/src/auth/manager.rs (2622 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-36ef2d30f186b43a", "name": "Very large file: codex-rs/login/src/auth/auth_tests.rs (2313 lines)", "shortDescription": {"text": "Very large file: codex-rs/login/src/auth/auth_tests.rs (2313 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e28b0c7494e91356", "name": "Very large file: codex-rs/chat-wire-compat/src/request.rs (1502 lines)", "shortDescription": {"text": "Very large file: codex-rs/chat-wire-compat/src/request.rs (1502 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a357f17d1ce6efb7", "name": "Very large file: codex-rs/windows-sandbox-rs/src/setup.rs (1955 lines)", "shortDescription": {"text": "Very large file: codex-rs/windows-sandbox-rs/src/setup.rs (1955 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9bae5bace3cae7f2", "name": "Very large file: codex-rs/cli/src/doctor.rs (4269 lines)", "shortDescription": {"text": "Very large file: codex-rs/cli/src/doctor.rs (4269 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-216004ce49e91e8b", "name": "Very large file: codex-rs/cli/src/main.rs (4145 lines)", "shortDescription": {"text": "Very large file: codex-rs/cli/src/main.rs (4145 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-261acd9bbc8dbc2c", "name": "Very large file: codex-rs/cli/src/doctor/output.rs (1705 lines)", "shortDescription": {"text": "Very large file: codex-rs/cli/src/doctor/output.rs (1705 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6942a22be005c725", "name": "Very large file: codex-rs/thread-store/src/local/update_thread_metadata.rs (1853 lines)", "shortDescription": {"text": "Very large file: codex-rs/thread-store/src/local/update_thread_metadata.rs (1853 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f793316ce47443ec", "name": "Very large file: codex-rs/thread-store/src/local/read_thread.rs (1366 lines)", "shortDescription": {"text": "Very large file: codex-rs/thread-store/src/local/read_thread.rs (1366 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5e18946247e2344f", "name": "Very large file: codex-rs/linux-sandbox/src/linux_run_main.rs (1470 lines)", "shortDescription": {"text": "Very large file: codex-rs/linux-sandbox/src/linux_run_main.rs (1470 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2a1b09b9ae3840d9", "name": "Very large file: codex-rs/linux-sandbox/src/bwrap.rs (2707 lines)", "shortDescription": {"text": "Very large file: codex-rs/linux-sandbox/src/bwrap.rs (2707 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d1c17f19847c1536", "name": "Very large file: codex-rs/core-skills/src/render.rs (1574 lines)", "shortDescription": {"text": "Very large file: codex-rs/core-skills/src/render.rs (1574 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-81084d02d15e7b11", "name": "Very large file: codex-rs/core-skills/src/loader_tests.rs (2438 lines)", "shortDescription": {"text": "Very large file: codex-rs/core-skills/src/loader_tests.rs (2438 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f2fddf67fceea149", "name": "Very large file: codex-rs/code-mode/src/remote_session/connection/driver_tests.rs (1514 lines)", "shortDescription": {"text": "Very large file: codex-rs/code-mode/src/remote_session/connection/driver_tests.rs (1514 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c590562a3c2ad21a", "name": "Very large file: codex-rs/shell-command/src/parse_command.rs (2530 lines)", "shortDescription": {"text": "Very large file: codex-rs/shell-command/src/parse_command.rs (2530 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e8ebafdcd6437b65", "name": "Very large file: codex-rs/codex-mcp/src/connection_manager_tests.rs (1766 lines)", "shortDescription": {"text": "Very large file: codex-rs/codex-mcp/src/connection_manager_tests.rs (1766 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bf713aa77a703d9c", "name": "Very large file: codex-rs/app-server-client/src/lib.rs (2377 lines)", "shortDescription": {"text": "Very large file: codex-rs/app-server-client/src/lib.rs (2377 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a70916bb67a7a9b", "name": "Very large file: codex-rs/sandboxing/src/seatbelt_tests.rs (1450 lines)", "shortDescription": {"text": "Very large file: codex-rs/sandboxing/src/seatbelt_tests.rs (1450 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e4b61e037c19469e", "name": "Very large file: codex-rs/hooks/src/engine/mod_tests.rs (1508 lines)", "shortDescription": {"text": "Very large file: codex-rs/hooks/src/engine/mod_tests.rs (1508 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-186be46a2bed0146", "name": "Very large file: codex-rs/exec/tests/event_processor_with_json_output.rs (1665 lines)", "shortDescription": {"text": "Very large file: codex-rs/exec/tests/event_processor_with_json_output.rs (1665 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8eee14f95a7d83f5", "name": "Very large file: codex-rs/exec/src/lib.rs (2085 lines)", "shortDescription": {"text": "Very large file: codex-rs/exec/src/lib.rs (2085 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d031e87b0e71884f", "name": "Very large file: codex-rs/tools/src/json_schema_tests.rs (2049 lines)", "shortDescription": {"text": "Very large file: codex-rs/tools/src/json_schema_tests.rs (2049 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-38568324a4fbaca6", "name": "Very large file: codex-rs/app-server/tests/common/test_app_server.rs (1954 lines)", "shortDescription": {"text": "Very large file: codex-rs/app-server/tests/common/test_app_server.rs (1954 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-86977b5d1b16912f", "name": "Very large file: codex-rs/app-server/tests/suite/v2/plugin_share.rs (1514 lines)", "shortDescription": {"text": "Very large file: codex-rs/app-server/tests/suite/v2/plugin_share.rs (1514 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8f470c5835a9c09e", "name": "Very large file: codex-rs/app-server/tests/suite/v2/app_list.rs (1918 lines)", "shortDescription": {"text": "Very large file: codex-rs/app-server/tests/suite/v2/app_list.rs (1918 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea07ddd32745edfe", "name": "Very large file: codex-rs/app-server/tests/suite/v2/thread_start.rs (1748 lines)", "shortDescription": {"text": "Very large file: codex-rs/app-server/tests/suite/v2/thread_start.rs (1748 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dc15cfa577c906af", "name": "Very large file: codex-rs/app-server/tests/suite/v2/thread_read.rs (1653 lines)", "shortDescription": {"text": "Very large file: codex-rs/app-server/tests/suite/v2/thread_read.rs (1653 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3b09b9904ba7cd29", "name": "Very large file: codex-rs/app-server/tests/suite/v2/plugin_install.rs (2645 lines)", "shortDescription": {"text": "Very large file: codex-rs/app-server/tests/suite/v2/plugin_install.rs (2645 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ddc63ce51b57e363", "name": "Very large file: codex-rs/app-server/tests/suite/v2/plugin_list.rs (4343 lines)", "shortDescription": {"text": "Very large file: codex-rs/app-server/tests/suite/v2/plugin_list.rs (4343 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ad3f089eb65ab604", "name": "Very large file: codex-rs/app-server/tests/suite/v2/realtime_conversation.rs (3183 lines)", "shortDescription": {"text": "Very large file: codex-rs/app-server/tests/suite/v2/realtime_conversation.rs (3183 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ec648c7ae2338f51", "name": "Very large file: codex-rs/app-server/tests/suite/v2/thread_resume.rs (4466 lines)", "shortDescription": {"text": "Very large file: codex-rs/app-server/tests/suite/v2/thread_resume.rs (4466 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-96ed9d98b20bc374", "name": "Very large file: codex-rs/app-server/tests/suite/v2/thread_list.rs (2282 lines)", "shortDescription": {"text": "Very large file: codex-rs/app-server/tests/suite/v2/thread_list.rs (2282 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a7b58edbab9f7b3", "name": "Very large file: codex-rs/app-server/tests/suite/v2/external_agent_config.rs (1506 lines)", "shortDescription": {"text": "Very large file: codex-rs/app-server/tests/suite/v2/external_agent_config.rs (1506 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a58255cdef733f54", "name": "Very large file: codex-rs/app-server/tests/suite/v2/turn_start.rs (4677 lines)", "shortDescription": {"text": "Very large file: codex-rs/app-server/tests/suite/v2/turn_start.rs (4677 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6cc031005bcd60c4", "name": "Very large file: codex-rs/app-server/tests/suite/v2/plugin_read.rs (2296 lines)", "shortDescription": {"text": "Very large file: codex-rs/app-server/tests/suite/v2/plugin_read.rs (2296 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-af3dd284891ef9fe", "name": "Very large file: codex-rs/app-server/tests/suite/v2/account.rs (2183 lines)", "shortDescription": {"text": "Very large file: codex-rs/app-server/tests/suite/v2/account.rs (2183 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2564ac53dd047037", "name": "Very large file: codex-rs/app-server/src/lib.rs (1413 lines)", "shortDescription": {"text": "Very large file: codex-rs/app-server/src/lib.rs (1413 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f96149aac138298b", "name": "Very large file: codex-rs/app-server/src/message_processor.rs (1465 lines)", "shortDescription": {"text": "Very large file: codex-rs/app-server/src/message_processor.rs (1465 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a41ff08af18b9ac6", "name": "Very large file: codex-rs/app-server/src/bespoke_event_handling.rs (3947 lines)", "shortDescription": {"text": "Very large file: codex-rs/app-server/src/bespoke_event_handling.rs (3947 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6f94ff7d01859fa5", "name": "Very large file: codex-rs/app-server/src/outgoing_message.rs (1389 lines)", "shortDescription": {"text": "Very large file: codex-rs/app-server/src/outgoing_message.rs (1389 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5959d89bb444e2a7", "name": "Very large file: codex-rs/app-server/src/config/external_agent_config_tests.rs (2796 lines)", "shortDescription": {"text": "Very large file: codex-rs/app-server/src/config/external_agent_config_tests.rs (2796 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-47450589b0170e8c", "name": "Very large file: codex-rs/app-server/src/config/external_agent_config.rs (1985 lines)", "shortDescription": {"text": "Very large file: codex-rs/app-server/src/config/external_agent_config.rs (1985 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f485c033676e4323", "name": "Very large file: codex-rs/app-server/src/request_processors/thread_processor.rs (4613 lines)", "shortDescription": {"text": "Very large file: codex-rs/app-server/src/request_processors/thread_processor.rs (4613 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-efe682c113eea181", "name": "Very large file: codex-rs/app-server/src/request_processors/turn_processor.rs (1457 lines)", "shortDescription": {"text": "Very large file: codex-rs/app-server/src/request_processors/turn_processor.rs (1457 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c2a7a1575b12ebdf", "name": "Very large file: codex-rs/app-server/src/request_processors/thread_processor_tests.rs (1513 lines)", "shortDescription": {"text": "Very large file: codex-rs/app-server/src/request_processors/thread_processor_tests.rs (1513 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7d6be6569d3b7c50", "name": "Very large file: codex-rs/app-server/src/request_processors/plugins.rs (2396 lines)", "shortDescription": {"text": "Very large file: codex-rs/app-server/src/request_processors/plugins.rs (2396 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-29f4c6724f932d1f", "name": "Very large file: codex-rs/core/tests/common/responses.rs (1738 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/tests/common/responses.rs (1738 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5e802484654f3d5a", "name": "Very large file: codex-rs/core/tests/suite/approvals.rs (3937 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/tests/suite/approvals.rs (3937 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e441d95022d323b8", "name": "Very large file: codex-rs/core/tests/suite/rmcp_client.rs (3108 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/tests/suite/rmcp_client.rs (3108 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-68569e23e427c67c", "name": "Very large file: codex-rs/core/tests/suite/apply_patch_cli.rs (1957 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/tests/suite/apply_patch_cli.rs (1957 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0cfadb9e5f25eb81", "name": "Very large file: codex-rs/core/tests/suite/code_mode.rs (4015 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/tests/suite/code_mode.rs (4015 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9cdbab814c5322c5", "name": "Very large file: codex-rs/core/tests/suite/unified_exec.rs (3549 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/tests/suite/unified_exec.rs (3549 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9764cbac48a5b20a", "name": "Very large file: codex-rs/core/tests/suite/realtime_conversation.rs (4315 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/tests/suite/realtime_conversation.rs (4315 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-951437223e6f8592", "name": "Very large file: codex-rs/core/tests/suite/remote_env.rs (1975 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/tests/suite/remote_env.rs (1975 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-185bada439ecc67b", "name": "Very large file: codex-rs/core/tests/suite/client_websockets.rs (2444 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/tests/suite/client_websockets.rs (2444 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dee0be6ff4743f2d", "name": "Very large file: codex-rs/core/tests/suite/otel.rs (1712 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/tests/suite/otel.rs (1712 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d1bddd3fc7e92d87", "name": "Very large file: codex-rs/core/tests/suite/subagent_notifications.rs (1536 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/tests/suite/subagent_notifications.rs (1536 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-547f629242bebbfd", "name": "Very large file: codex-rs/core/tests/suite/search_tool.rs (1621 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/tests/suite/search_tool.rs (1621 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-df6caddf9162fd73", "name": "Very large file: codex-rs/core/tests/suite/compact_remote.rs (4371 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/tests/suite/compact_remote.rs (4371 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-42f7cdf72ac78ebf", "name": "Very large file: codex-rs/core/tests/suite/view_image.rs (1542 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/tests/suite/view_image.rs (1542 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ac7910c4f4acb65", "name": "Very large file: codex-rs/core/tests/suite/request_permissions.rs (1942 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/tests/suite/request_permissions.rs (1942 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-116006ae54fb8e3a", "name": "Very large file: codex-rs/core/tests/suite/client.rs (3852 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/tests/suite/client.rs (3852 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49bac79a86c666ee", "name": "Very large file: codex-rs/core/tests/suite/hooks.rs (4249 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/tests/suite/hooks.rs (4249 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a94cb123338291b4", "name": "Very large file: codex-rs/core/tests/suite/compact.rs (5293 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/tests/suite/compact.rs (5293 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ab60af74a7fb1ec4", "name": "Very large file: codex-rs/core/src/thread_manager.rs (1921 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/src/thread_manager.rs (1921 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9db101f70c279e6e", "name": "Very large file: codex-rs/core/src/mcp_tool_call_tests.rs (3118 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/src/mcp_tool_call_tests.rs (3118 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-98b23cc0f5158a1d", "name": "Very large file: codex-rs/core/src/thread_manager_tests.rs (1885 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/src/thread_manager_tests.rs (1885 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fdcc6dd41c78050b", "name": "Very large file: codex-rs/core/src/realtime_conversation.rs (1846 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/src/realtime_conversation.rs (1846 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-306bae210d2e196b", "name": "Very large file: codex-rs/core/src/mcp_tool_call.rs (2231 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/src/mcp_tool_call.rs (2231 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-add9b0706d51e2b7", "name": "Very large file: codex-rs/core/src/exec_policy_tests.rs (2428 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/src/exec_policy_tests.rs (2428 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8066ffa88006eebf", "name": "Very large file: codex-rs/core/src/client.rs (3609 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/src/client.rs (3609 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-00d20f348eac372b", "name": "Very large file: codex-rs/core/src/config/config_tests.rs (11421 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/src/config/config_tests.rs (11421 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b012d588ea1f524a", "name": "Very large file: codex-rs/core/src/config/mod.rs (4383 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/src/config/mod.rs (4383 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4f4d48e1edb27b36", "name": "Very large file: codex-rs/core/src/config/config_loader_tests.rs (3828 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/src/config/config_loader_tests.rs (3828 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b34e2c140998016c", "name": "Very large file: codex-rs/core/src/agent/control_tests.rs (3466 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/src/agent/control_tests.rs (3466 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ae64e6f1c06d1408", "name": "Very large file: codex-rs/core/src/guardian/review_session.rs (1913 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/src/guardian/review_session.rs (1913 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-02413d10fc4d95bf", "name": "Very large file: codex-rs/core/src/guardian/tests.rs (3207 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/src/guardian/tests.rs (3207 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-36f752dc90ef94de", "name": "Very large file: codex-rs/core/src/tools/spec_plan_tests.rs (1662 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/src/tools/spec_plan_tests.rs (1662 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e3f18e79d6328cd0", "name": "Very large file: codex-rs/core/src/tools/handlers/harness_aliases.rs (5212 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/src/tools/handlers/harness_aliases.rs (5212 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-57c6a50cd8e5cc9e", "name": "Very large file: codex-rs/core/src/tools/handlers/multi_agents_tests.rs (4573 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/src/tools/handlers/multi_agents_tests.rs (4573 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ee19eadbf7bc786", "name": "Very large file: codex-rs/core/src/context_manager/history_tests.rs (2259 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/src/context_manager/history_tests.rs (2259 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-766b0c1dbbb4951e", "name": "Very large file: codex-rs/core/src/session/rollout_reconstruction_tests.rs (1902 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/src/session/rollout_reconstruction_tests.rs (1902 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bd6f94539bee8dcf", "name": "Very large file: codex-rs/core/src/session/mod.rs (4086 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/src/session/mod.rs (4086 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-072e9da6666a6857", "name": "Very large file: codex-rs/core/src/session/turn.rs (2603 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/src/session/turn.rs (2603 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-96f2b57b99c3a584", "name": "Very large file: codex-rs/core/src/session/session.rs (1312 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/src/session/session.rs (1312 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-79fa9ec2dccad0d9", "name": "Very large file: codex-rs/core/src/session/tests.rs (11081 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/src/session/tests.rs (11081 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-096fb96200c7a90d", "name": "Very large file: codex-rs/core/src/harness/opencode.rs (864 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/src/harness/opencode.rs (864 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-da4b884f8ed3d75c", "name": "Very large file: codex-rs/core/src/harness/terminus_2.rs (2138 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/src/harness/terminus_2.rs (2138 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-446b54d4a08a57d2", "name": "Very large file: codex-rs/core/src/harness/zcode.rs (2654 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/src/harness/zcode.rs (2654 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d7a9181c84506770", "name": "Very large file: codex-rs/core/src/harness/claude_code.rs (4702 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/src/harness/claude_code.rs (4702 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-35900dd40b4ae016", "name": "Very large file: codex-rs/core/src/harness/kimi_cli.rs (2820 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/src/harness/kimi_cli.rs (2820 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a3fc7159d7ec1c59", "name": "Very large file: codex-rs/core/src/unified_exec/process_manager.rs (1462 lines)", "shortDescription": {"text": "Very large file: codex-rs/core/src/unified_exec/process_manager.rs (1462 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3637195500f63a59", "name": "Very large file: codex-rs/app-server-protocol/src/export.rs (3014 lines)", "shortDescription": {"text": "Very large file: codex-rs/app-server-protocol/src/export.rs (3014 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0a7288897b18a805", "name": "Very large file: codex-rs/app-server-protocol/src/protocol/thread_history.rs (4384 lines)", "shortDescription": {"text": "Very large file: codex-rs/app-server-protocol/src/protocol/thread_history.rs (4384 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8b203b6d510ec8d5", "name": "Very large file: codex-rs/app-server-protocol/src/protocol/common.rs (3801 lines)", "shortDescription": {"text": "Very large file: codex-rs/app-server-protocol/src/protocol/common.rs (3801 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d393b7266e03cb90", "name": "Very large file: codex-rs/app-server-protocol/src/protocol/v2/item.rs (1646 lines)", "shortDescription": {"text": "Very large file: codex-rs/app-server-protocol/src/protocol/v2/item.rs (1646 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3281d7cb067c2c0e", "name": "Very large file: codex-rs/app-server-protocol/src/protocol/v2/thread.rs (1506 lines)", "shortDescription": {"text": "Very large file: codex-rs/app-server-protocol/src/protocol/v2/thread.rs (1506 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e61abb6f3347e95c", "name": "Very large file: codex-rs/app-server-protocol/src/protocol/v2/tests.rs (4333 lines)", "shortDescription": {"text": "Very large file: codex-rs/app-server-protocol/src/protocol/v2/tests.rs (4333 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0c2c781c4e0de291", "name": "Very large file: codex-rs/protocol/src/protocol.rs (6205 lines)", "shortDescription": {"text": "Very large file: codex-rs/protocol/src/protocol.rs (6205 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f4ebe21cd2179639", "name": "Very large file: codex-rs/protocol/src/models.rs (3669 lines)", "shortDescription": {"text": "Very large file: codex-rs/protocol/src/models.rs (3669 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a6ddf04de5a953f0", "name": "Very large file: codex-rs/protocol/src/permissions.rs (3269 lines)", "shortDescription": {"text": "Very large file: codex-rs/protocol/src/permissions.rs (3269 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e84e8d0d6094e6b0", "name": "Very large file: codex-rs/codex-api/src/endpoint/realtime_websocket/methods.rs (2490 lines)", "shortDescription": {"text": "Very large file: codex-rs/codex-api/src/endpoint/realtime_websocket/methods.rs (2490 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bbb456ec00102944", "name": "Very large file: codex-rs/codex-api/src/sse/responses.rs (1633 lines)", "shortDescription": {"text": "Very large file: codex-rs/codex-api/src/sse/responses.rs (1633 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e9d57a543c116c9c", "name": "Very large file: codex-rs/rollout/src/list.rs (1544 lines)", "shortDescription": {"text": "Very large file: codex-rs/rollout/src/list.rs (1544 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c1a9c9be60d13fd7", "name": "Very large file: codex-rs/rollout/src/recorder.rs (1975 lines)", "shortDescription": {"text": "Very large file: codex-rs/rollout/src/recorder.rs (1975 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-44e8e5f70512f47f", "name": "Very large file: codex-rs/rollout/src/tests.rs (1720 lines)", "shortDescription": {"text": "Very large file: codex-rs/rollout/src/tests.rs (1720 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6cae4cbfeffe6ab6", "name": "Very large file: codex-rs/external-agent-migration/src/lib.rs (2211 lines)", "shortDescription": {"text": "Very large file: codex-rs/external-agent-migration/src/lib.rs (2211 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-da27ee54b2064408", "name": "Very large file: codex-rs/apply-patch/src/lib.rs (1719 lines)", "shortDescription": {"text": "Very large file: codex-rs/apply-patch/src/lib.rs (1719 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7b25b71a1b563894", "name": "Very large file: codex-rs/app-server-test-client/src/lib.rs (2354 lines)", "shortDescription": {"text": "Very large file: codex-rs/app-server-test-client/src/lib.rs (2354 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-edaeeefa062ff957", "name": "Very large file: codex-rs/network-proxy/src/http_proxy.rs (1631 lines)", "shortDescription": {"text": "Very large file: codex-rs/network-proxy/src/http_proxy.rs (1631 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e3a57bf045782fa0", "name": "Very large file: codex-rs/network-proxy/src/proxy.rs (1617 lines)", "shortDescription": {"text": "Very large file: codex-rs/network-proxy/src/proxy.rs (1617 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7e0e7973edfcd67b", "name": "Very large file: codex-rs/network-proxy/src/runtime.rs (2135 lines)", "shortDescription": {"text": "Very large file: codex-rs/network-proxy/src/runtime.rs (2135 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2e27019f5191c3d1", "name": "Very large file: codex-rs/core-plugins/src/marketplace_tests.rs (2239 lines)", "shortDescription": {"text": "Very large file: codex-rs/core-plugins/src/marketplace_tests.rs (2239 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-66474b37a2b178f6", "name": "Very large file: codex-rs/core-plugins/src/manager.rs (2761 lines)", "shortDescription": {"text": "Very large file: codex-rs/core-plugins/src/manager.rs (2761 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f491352da15f7122", "name": "Very large file: codex-rs/core-plugins/src/loader.rs (1521 lines)", "shortDescription": {"text": "Very large file: codex-rs/core-plugins/src/loader.rs (1521 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e852b50bc56ebdde", "name": "Very large file: codex-rs/core-plugins/src/manager_tests.rs (5876 lines)", "shortDescription": {"text": "Very large file: codex-rs/core-plugins/src/manager_tests.rs (5876 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-baf6bf437d427c28", "name": "Very large file: codex-rs/core-plugins/src/remote.rs (1963 lines)", "shortDescription": {"text": "Very large file: codex-rs/core-plugins/src/remote.rs (1963 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6b8a69741998e816", "name": "Very large file: codex-rs/app-server-transport/src/transport/remote_control/websocket.rs (3522 lines)", "shortDescription": {"text": "Very large file: codex-rs/app-server-transport/src/transport/remote_control/websocket.rs (3522 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a2be8164e24475af", "name": "Very large file: codex-rs/app-server-transport/src/transport/remote_control/tests.rs (2853 lines)", "shortDescription": {"text": "Very large file: codex-rs/app-server-transport/src/transport/remote_control/tests.rs (2853 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d5ba0513cb82bb6", "name": "Very large file: sdk/python/scripts/update_sdk_artifacts.py (1376 lines)", "shortDescription": {"text": "Very large file: sdk/python/scripts/update_sdk_artifacts.py (1376 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-76a330f67230c4fa", "name": "Very large file: sdk/python/src/openai_codex/generated/v2_all.py (8619 lines)", "shortDescription": {"text": "Very large file: sdk/python/src/openai_codex/generated/v2_all.py (8619 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e9c1f12e755b9d8", "name": "136 TODO/FIXME markers", "shortDescription": {"text": "136 TODO/FIXME markers"}, "fullDescription": {"text": "High count of TODO/FIXME/HACK markers \u2014 track them as issues so they're not forgotten."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-94c600503366fc46", "name": "Node manifest has dependencies but no lockfile: sdk/typescript/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: sdk/typescript/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 373 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 488 placeholder/mock markers across 104 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9d79c4077342a7d0", "name": "Runtime service client appears to use placeholder configuration", "shortDescription": {"text": "Runtime service client appears to use placeholder configuration"}, "fullDescription": {"text": "A runtime source file appears to wire Supabase/Firebase/AI/payment-style clients to placeholder URLs, keys, or fallback values. In the Fable corpus this often means the UI/API shape is present while the backend service is not actually configured."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-69bdca36b063bcb4", "name": "Network/subprocess call without timeout or try/except \u2014 codex-rs/windows-sandbox-rs/sandbox_smoketests.py:130", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 codex-rs/windows-sandbox-rs/sandbox_smoketests.py:130"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-29a90d3e68be3dba", "name": "Stub function `log_message` (body is just `pass`/`return`) \u2014 codex-rs/windows-sandbox-rs/sandbox_smoketests.py:146", "shortDescription": {"text": "Stub function `log_message` (body is just `pass`/`return`) \u2014 codex-rs/windows-sandbox-rs/sandbox_smoketests.py:146"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-242c4c638084858d", "name": "Network/subprocess call without timeout or try/except \u2014 codex-rs/skills/src/assets/samples/skill-installer/scripts/githu", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 codex-rs/skills/src/assets/samples/skill-installer/scripts/github_utils.py:16"}, "fullDescription": {"text": "`urllib.request.urlopen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d38a630d9cb1dd89", "name": "Network/subprocess call without timeout or try/except \u2014 codex-rs/skills/src/assets/samples/skill-installer/scripts/insta", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 codex-rs/skills/src/assets/samples/skill-installer/scripts/install-skill-from-github.py:100"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6ef50357721eb4ca", "name": "`fetch()` without try/.catch or AbortSignal \u2014 codex-rs/skills/src/assets/samples/openai-docs/scripts/fetch-codex-manual.", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 codex-rs/skills/src/assets/samples/openai-docs/scripts/fetch-codex-manual.mjs:175"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b49c3cf69a969d22", "name": "`fetch()` without try/.catch or AbortSignal \u2014 codex-rs/skills/src/assets/samples/openai-docs/scripts/resolve-latest-mode", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 codex-rs/skills/src/assets/samples/openai-docs/scripts/resolve-latest-model-info.js:39"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2b3fc9d1a09c91d4", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/check_blob_size.py:25", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/check_blob_size.py:25"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9863990bb56aa86c", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/format.py:52", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/format.py:52"}, "fullDescription": {"text": "`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1452394444602e77", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/stage_npm_packages.py:150", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/stage_npm_packages.py:150"}, "fullDescription": {"text": "`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9f5dd2c14e81d590", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/just-shell.py:57", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/just-shell.py:57"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3c2ae80f739f5045", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/codex_package/cargo.py:81", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/codex_package/cargo.py:81"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cceb500ec89aec57", "name": "Network/subprocess call without timeout or try/except \u2014 codex-cli/scripts/build_npm_package.py:329", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 codex-cli/scripts/build_npm_package.py:329"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e4a8c9a1c8984a3d", "name": "Network/subprocess call without timeout or try/except \u2014 .github/scripts/v8_canary_changes.py:117", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 .github/scripts/v8_canary_changes.py:117"}, "fullDescription": {"text": "`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b86b0f4fa0c4d395", "name": "Network/subprocess call without timeout or try/except \u2014 .github/scripts/rusty_v8_bazel.py:33", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 .github/scripts/rusty_v8_bazel.py:33"}, "fullDescription": {"text": "`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-19f056b6d6f3b9e8", "name": "Network/subprocess call without timeout or try/except \u2014 .github/scripts/run_bazel_with_buildbuddy.py:210", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 .github/scripts/run_bazel_with_buildbuddy.py:210"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-74c72de59e7442bd", "name": "Network/subprocess call without timeout or try/except \u2014 sdk/python/_runtime_setup.py:126", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 sdk/python/_runtime_setup.py:126"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fef73b35db66eb72", "name": "Legacy-named symbol `pydantic_v2` in sdk/python/scripts/update_sdk_artifacts.py:595", "shortDescription": {"text": "Legacy-named symbol `pydantic_v2` in sdk/python/scripts/update_sdk_artifacts.py:595"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e0f04258ee5d3fa8", "name": "Network/subprocess call without timeout or try/except \u2014 sdk/python/scripts/update_sdk_artifacts.py:65", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 sdk/python/scripts/update_sdk_artifacts.py:65"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-111255916c602937", "name": "Legacy-named symbol `model_copy` in sdk/python/src/openai_codex/_goal.py:214", "shortDescription": {"text": "Legacy-named symbol `model_copy` in sdk/python/src/openai_codex/_goal.py:214"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-251745b7cb25292b", "name": "Legacy-named symbol `upgrade_copy` in sdk/python/src/openai_codex/generated/v2_all.py:2118", "shortDescription": {"text": "Legacy-named symbol `upgrade_copy` in sdk/python/src/openai_codex/generated/v2_all.py:2118"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\ncodex-rs/windows-sandbox-rs/sandbox_smoketests.py:do_GET, codex-rs/windows-sandbox-rs/sandbox_smoketests.py:do_GET\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsdk/python/src/openai_codex/client.py:request, sdk/python/src/openai_codex/client.py:request_with_retry_on_overload, sdk/python/src/openai_codex/async_client.py:request, sdk/python/src/openai_codex/async_client.py:request_with_retry_on_overload\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ffd670c4e7be5fb3", "name": "Vulnerable dependency anyhow 1.0.102: RUSTSEC-2026-0190", "shortDescription": {"text": "Vulnerable dependency anyhow 1.0.102: RUSTSEC-2026-0190"}, "fullDescription": {"text": "OSV.dev reports `anyhow` at version `1.0.102` (resolved in `codex-rs/Cargo.lock`) is affected by RUSTSEC-2026-0190.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2026-0190\nFix: upgrade `anyhow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a85881aba6042985", "name": "Vulnerable dependency gix 0.81.0: GHSA-f26g-jm89-4g65", "shortDescription": {"text": "Vulnerable dependency gix 0.81.0: GHSA-f26g-jm89-4g65"}, "fullDescription": {"text": "OSV.dev reports `gix` at version `0.81.0` (resolved in `codex-rs/Cargo.lock`) is affected by GHSA-f26g-jm89-4g65 (aka CVE-2026-40034).\n\ngitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execution via .gitmodules\n\nAliases: CVE-2026-40034\nAdvisory: https://osv.dev/vulnerability/GHSA-f26g-jm89-4g65\nFix: upgrade `gix` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2a0c44e9a724f4cd", "name": "Vulnerable dependency gix 0.81.0: GHSA-fr8x-3vfx-f45h", "shortDescription": {"text": "Vulnerable dependency gix 0.81.0: GHSA-fr8x-3vfx-f45h"}, "fullDescription": {"text": "OSV.dev reports `gix` at version `0.81.0` (resolved in `codex-rs/Cargo.lock`) is affected by GHSA-fr8x-3vfx-f45h.\n\ngix and gitoxide: unvalidated submodule name traverses out of .git/modules and redirects state() / open() to another repository\n\nAdvisory: https://osv.dev/vulnerability/GHSA-fr8x-3vfx-f45h\nFix: upgrade `gix` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-46af6b041fa39279", "name": "Vulnerable dependency gix 0.81.0: GHSA-p3hw-mv63-rf9w", "shortDescription": {"text": "Vulnerable dependency gix 0.81.0: GHSA-p3hw-mv63-rf9w"}, "fullDescription": {"text": "OSV.dev reports `gix` at version `0.81.0` (resolved in `codex-rs/Cargo.lock`) is affected by GHSA-p3hw-mv63-rf9w.\n\ngix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosure\n\nAdvisory: https://osv.dev/vulnerability/GHSA-p3hw-mv63-rf9w\nFix: upgrade `gix` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7981fe9a5fea62e2", "name": "Vulnerable dependency gix 0.81.0: GHSA-pg4w-g64p-qwhj", "shortDescription": {"text": "Vulnerable dependency gix 0.81.0: GHSA-pg4w-g64p-qwhj"}, "fullDescription": {"text": "OSV.dev reports `gix` at version `0.81.0` (resolved in `codex-rs/Cargo.lock`) is affected by GHSA-pg4w-g64p-qwhj.\n\ngix and gitoxide's symlinked .gitmodules are followed and parsed from outside of the repository\n\nAdvisory: https://osv.dev/vulnerability/GHSA-pg4w-g64p-qwhj\nFix: upgrade `gix` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f0e41eebfdfd706c", "name": "Vulnerable dependency jsonwebtoken 9.3.1: GHSA-h395-gr6q-cpjc", "shortDescription": {"text": "Vulnerable dependency jsonwebtoken 9.3.1: GHSA-h395-gr6q-cpjc"}, "fullDescription": {"text": "OSV.dev reports `jsonwebtoken` at version `9.3.1` (resolved in `codex-rs/Cargo.lock`) is affected by GHSA-h395-gr6q-cpjc (aka CVE-2026-25537).\n\njsonwebtoken has Type Confusion that leads to potential authorization bypass\n\nAliases: CVE-2026-25537\nAdvisory: https://osv.dev/vulnerability/GHSA-h395-gr6q-cpjc\nFix: upgrade `jsonwebtoken` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f91e5b1408347ad4", "name": "Vulnerable dependency lru 0.12.5: GHSA-rhfx-m35p-ff5j", "shortDescription": {"text": "Vulnerable dependency lru 0.12.5: GHSA-rhfx-m35p-ff5j"}, "fullDescription": {"text": "OSV.dev reports `lru` at version `0.12.5` (resolved in `codex-rs/Cargo.lock`) is affected by GHSA-rhfx-m35p-ff5j.\n\n`IterMut` violates Stacked Borrows by invalidating internal pointer\n\nAliases: RUSTSEC-2026-0002\nAdvisory: https://osv.dev/vulnerability/GHSA-rhfx-m35p-ff5j\nFix: upgrade `lru` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1d9127eb8271bb87", "name": "Vulnerable dependency opentelemetry_sdk 0.31.0: GHSA-w9wp-h8wv-79jx", "shortDescription": {"text": "Vulnerable dependency opentelemetry_sdk 0.31.0: GHSA-w9wp-h8wv-79jx"}, "fullDescription": {"text": "OSV.dev reports `opentelemetry_sdk` at version `0.31.0` (resolved in `codex-rs/Cargo.lock`) is affected by GHSA-w9wp-h8wv-79jx (aka CVE-2026-48504).\n\nopentelemetry_sdk has unbounded memory allocation in W3C Baggage propagation\n\nAliases: CVE-2026-48504\nAdvisory: https://osv.dev/vulnerability/GHSA-w9wp-h8wv-79jx\nFix: upgrade `opentelemetry_sdk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d2f52510596b5848", "name": "Vulnerable dependency quick-xml 0.39.4: RUSTSEC-2026-0194", "shortDescription": {"text": "Vulnerable dependency quick-xml 0.39.4: RUSTSEC-2026-0194"}, "fullDescription": {"text": "OSV.dev reports `quick-xml` at version `0.39.4` (resolved in `codex-rs/Cargo.lock`) is affected by RUSTSEC-2026-0194.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2026-0194\nFix: upgrade `quick-xml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b330f3118570d843", "name": "Vulnerable dependency quick-xml 0.39.4: RUSTSEC-2026-0195", "shortDescription": {"text": "Vulnerable dependency quick-xml 0.39.4: RUSTSEC-2026-0195"}, "fullDescription": {"text": "OSV.dev reports `quick-xml` at version `0.39.4` (resolved in `codex-rs/Cargo.lock`) is affected by RUSTSEC-2026-0195.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2026-0195\nFix: upgrade `quick-xml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-150b355e79ae9965", "name": "Vulnerable dependency tar 0.4.45: GHSA-3pv8-6f4r-ffg2", "shortDescription": {"text": "Vulnerable dependency tar 0.4.45: GHSA-3pv8-6f4r-ffg2"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `0.4.45` (resolved in `codex-rs/Cargo.lock`) is affected by GHSA-3pv8-6f4r-ffg2.\n\ntar has a PAX header desynchronization issue\n\nAdvisory: https://osv.dev/vulnerability/GHSA-3pv8-6f4r-ffg2\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7089087a558930a5", "name": "Vulnerable dependency tar 0.4.44: GHSA-3pv8-6f4r-ffg2", "shortDescription": {"text": "Vulnerable dependency tar 0.4.44: GHSA-3pv8-6f4r-ffg2"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `0.4.44` (resolved in `tools/argument-comment-lint/Cargo.lock`) is affected by GHSA-3pv8-6f4r-ffg2.\n\ntar has a PAX header desynchronization issue\n\nAdvisory: https://osv.dev/vulnerability/GHSA-3pv8-6f4r-ffg2\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6c13a20cb6a7e70f", "name": "Vulnerable dependency tar 0.4.44: GHSA-gchp-q4r4-x4ff", "shortDescription": {"text": "Vulnerable dependency tar 0.4.44: GHSA-gchp-q4r4-x4ff"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `0.4.44` (resolved in `tools/argument-comment-lint/Cargo.lock`) is affected by GHSA-gchp-q4r4-x4ff (aka CVE-2026-33055).\n\ntar-rs incorrectly ignores PAX size headers if header size is nonzero\n\nAliases: CVE-2026-33055, RUSTSEC-2026-0068\nAdvisory: https://osv.dev/vulnerability/GHSA-gchp-q4r4-x4ff\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b31e0b6948b78b65", "name": "Vulnerable dependency tar 0.4.44: GHSA-j4xf-2g29-59ph", "shortDescription": {"text": "Vulnerable dependency tar 0.4.44: GHSA-j4xf-2g29-59ph"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `0.4.44` (resolved in `tools/argument-comment-lint/Cargo.lock`) is affected by GHSA-j4xf-2g29-59ph (aka CVE-2026-33056).\n\ntar-rs `unpack_in` can chmod arbitrary directories by following symlinks\n\nAliases: CVE-2026-33056, RUSTSEC-2026-0067\nAdvisory: https://osv.dev/vulnerability/GHSA-j4xf-2g29-59ph\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b46b44ec265fc0f4", "name": "Vulnerable dependency actix-http 3.11.2: GHSA-xhj4-vrgc-hr34", "shortDescription": {"text": "Vulnerable dependency actix-http 3.11.2: GHSA-xhj4-vrgc-hr34"}, "fullDescription": {"text": "OSV.dev reports `actix-http` at version `3.11.2` (resolved in `codex-rs/Cargo.lock`) is affected by GHSA-xhj4-vrgc-hr34.\nNote: `actix-http` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nactix-http has HTTP/1.1 CL.TE Request Smuggling\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xhj4-vrgc-hr34\nFix: upgrade `actix-http` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-f30114950388ab6b", "name": "Vulnerable dependency atomic-polyfill 1.0.3: RUSTSEC-2023-0089", "shortDescription": {"text": "Vulnerable dependency atomic-polyfill 1.0.3: RUSTSEC-2023-0089"}, "fullDescription": {"text": "OSV.dev reports `atomic-polyfill` at version `1.0.3` (resolved in `codex-rs/Cargo.lock`) is affected by RUSTSEC-2023-0089.\nNote: `atomic-polyfill` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\natomic-polyfill is unmaintained\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2023-0089\nFix: upgrade `atomic-polyfill` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-906635012de5d66d", "name": "Vulnerable dependency bincode 1.3.3: RUSTSEC-2025-0141", "shortDescription": {"text": "Vulnerable dependency bincode 1.3.3: RUSTSEC-2025-0141"}, "fullDescription": {"text": "OSV.dev reports `bincode` at version `1.3.3` (resolved in `codex-rs/Cargo.lock`) is affected by RUSTSEC-2025-0141.\nNote: `bincode` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nBincode is unmaintained\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2025-0141\nFix: upgrade `bincode` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-464d8c6972dac162", "name": "Vulnerable dependency cmov 0.5.3: GHSA-3rjw-m598-pq24", "shortDescription": {"text": "Vulnerable dependency cmov 0.5.3: GHSA-3rjw-m598-pq24"}, "fullDescription": {"text": "OSV.dev reports `cmov` at version `0.5.3` (resolved in `codex-rs/Cargo.lock`) is affected by GHSA-3rjw-m598-pq24 (aka CVE-2026-50185).\nNote: `cmov` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nCmov/CmovEq on aarch64 can produce wrong results if high-bits of registers are set\n\nAliases: CVE-2026-50185\nAdvisory: https://osv.dev/vulnerability/GHSA-3rjw-m598-pq24\nFix: upgrade `cmov` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-b609d0440e456c53", "name": "Vulnerable dependency cxx 1.0.194: RUSTSEC-2026-0202", "shortDescription": {"text": "Vulnerable dependency cxx 1.0.194: RUSTSEC-2026-0202"}, "fullDescription": {"text": "OSV.dev reports `cxx` at version `1.0.194` (resolved in `codex-rs/Cargo.lock`) is affected by RUSTSEC-2026-0202.\nNote: `cxx` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2026-0202\nFix: upgrade `cxx` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-36b5d007100b3453", "name": "Vulnerable dependency derivative 2.2.0: RUSTSEC-2024-0388", "shortDescription": {"text": "Vulnerable dependency derivative 2.2.0: RUSTSEC-2024-0388"}, "fullDescription": {"text": "OSV.dev reports `derivative` at version `2.2.0` (resolved in `codex-rs/Cargo.lock`) is affected by RUSTSEC-2024-0388.\nNote: `derivative` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\n`derivative` is unmaintained; consider using an alternative\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2024-0388\nFix: upgrade `derivative` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-06efaaa98b4036d1", "name": "Dependency agent-client-protocol is a major version behind", "shortDescription": {"text": "Dependency agent-client-protocol is a major version behind"}, "fullDescription": {"text": "`agent-client-protocol` is pinned at `0.12.1` in `codex-rs/acp-server/Cargo.toml` while the latest release on the cargo registry is `1.3.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `agent-client-protocol` to `1.3.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-84717f7c2f6f8895", "name": "Dependency ansi-to-tui is a major version behind", "shortDescription": {"text": "Dependency ansi-to-tui is a major version behind"}, "fullDescription": {"text": "`ansi-to-tui` is pinned at `7.0.0` in `codex-rs/ansi-escape/Cargo.toml` while the latest release on the cargo registry is `8.0.1` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `ansi-to-tui` to `8.0.1`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-b671cefe77e5804c", "name": "Dependency chardetng is a major version behind", "shortDescription": {"text": "Dependency chardetng is a major version behind"}, "fullDescription": {"text": "`chardetng` is pinned at `0.1.17` in `codex-rs/protocol/Cargo.toml` while the latest release on the cargo registry is `1.0.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `chardetng` to `1.0.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-c91037490406c768", "name": "Dependency ctor is a major version behind", "shortDescription": {"text": "Dependency ctor is a major version behind"}, "fullDescription": {"text": "`ctor` is pinned at `0.6.3` in `codex-rs/core/tests/common/Cargo.toml` while the latest release on the cargo registry is `1.0.10` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `ctor` to `1.0.10`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}]}}, "automationDetails": {"id": "repobility/30773"}, "properties": {"repository": "openinterpreter/openinterpreter", "repoUrl": "https://github.com/openinterpreter/openinterpreter", "branch": "main"}, "results": [{"ruleId": "scanner-87cfc525ccbac7c3", "level": "note", "message": {"text": "Possibly dead Python function: install_single_codex_package_archive"}, "properties": {"repobilityId": "1e262a21bd394c5a", "scanner": "scanner-primary", "fingerprint": "87cfc525ccbac7c3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/stage_npm_packages.py:340"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2250301f6686b9d6", "level": "note", "message": {"text": "Possibly dead Python function: install_single_binary"}, "properties": {"repobilityId": "b7bfd129ff50443a", "scanner": "scanner-primary", "fingerprint": "2250301f6686b9d6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/stage_npm_packages.py:391"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a5c0f82fd3ee34ce", "level": "note", "message": {"text": "Possibly dead Python function: handler"}, "properties": {"repobilityId": "bd219af3bd678eef", "scanner": "scanner-primary", "fingerprint": "a5c0f82fd3ee34ce", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/mock_responses_websocket_server.py:143"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-495cde7d43785445", "level": "note", "message": {"text": "Possibly dead Python function: current_sdk_version"}, "properties": {"repobilityId": "2df02d6cfc1a3d47", "scanner": "scanner-primary", "fingerprint": "495cde7d43785445", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sdk/python/scripts/update_sdk_artifacts.py:72"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0d1dae851bd7fd96", "level": "note", "message": {"text": "Possibly dead Python function: request_with_retry_on_overload"}, "properties": {"repobilityId": "a2ea6550a01e133e", "scanner": "scanner-primary", "fingerprint": "0d1dae851bd7fd96", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sdk/python/src/openai_codex/client.py:671"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c77d6a3ad34efda9", "level": "note", "message": {"text": "Possibly dead Python function: default_codex_home"}, "properties": {"repobilityId": "700a05bee2db08cd", "scanner": "scanner-primary", "fingerprint": "c77d6a3ad34efda9", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sdk/python/src/openai_codex/client.py:863"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dd93029e6ce7340d", "level": "note", "message": {"text": "Possibly dead Python function: begin_interrupt"}, "properties": {"repobilityId": "564a5717786e1386", "scanner": "scanner-primary", "fingerprint": "dd93029e6ce7340d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sdk/python/src/openai_codex/_goal.py:130"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-20767039b6113e12", "level": "note", "message": {"text": "Possibly dead Python function: confirm_interrupt"}, "properties": {"repobilityId": "5ba824a98485b2f1", "scanner": "scanner-primary", "fingerprint": "20767039b6113e12", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sdk/python/src/openai_codex/_goal.py:137"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1a61c762302b0578", "level": "note", "message": {"text": "Possibly dead Python function: cancel_interrupt"}, "properties": {"repobilityId": "97511c802fda806e", "scanner": "scanner-primary", "fingerprint": "1a61c762302b0578", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sdk/python/src/openai_codex/_goal.py:143"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b1c115bfdbfaee17", "level": "note", "message": {"text": "Possibly dead Python function: active_turn"}, "properties": {"repobilityId": "3e37ddf0a48b659d", "scanner": "scanner-primary", "fingerprint": "b1c115bfdbfaee17", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sdk/python/src/openai_codex/_goal.py:154"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b5d7c01b70a26322", "level": "note", "message": {"text": "Possibly dead Python function: resolve_active_turn"}, "properties": {"repobilityId": "b2c3aedd5ffe10cb", "scanner": "scanner-primary", "fingerprint": "b5d7c01b70a26322", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sdk/python/src/openai_codex/_goal.py:173"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fffbd097ebb5cdf1", "level": "note", "message": {"text": "Possibly dead Python function: login_chatgpt_device_code"}, "properties": {"repobilityId": "b14199531182d286", "scanner": "scanner-primary", "fingerprint": "fffbd097ebb5cdf1", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sdk/python/src/openai_codex/api.py:356"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-df1443ef4b3c35ea", "level": "note", "message": {"text": "Possibly dead Python function: logout"}, "properties": {"repobilityId": "8de76350e22b4132", "scanner": "scanner-primary", "fingerprint": "df1443ef4b3c35ea", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sdk/python/src/openai_codex/api.py:366"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5b2e5a8d7026a4af", "level": "note", "message": {"text": "Possibly dead Python function: start_operation"}, "properties": {"repobilityId": "579d86d6c16d879b", "scanner": "scanner-primary", "fingerprint": "5b2e5a8d7026a4af", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sdk/python/src/openai_codex/async_client.py:244"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1b7f45d695a692f7", "level": "note", "message": {"text": "Possibly dead Python function: cleanup_cancelled_start"}, "properties": {"repobilityId": "d2acbe72fc247a70", "scanner": "scanner-primary", "fingerprint": "1b7f45d695a692f7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sdk/python/src/openai_codex/async_client.py:260"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b4ca43fa964932a6", "level": "note", "message": {"text": "Possibly dead Python function: stop_cancelled_goal"}, "properties": {"repobilityId": "3df0fd9ad8d0f074", "scanner": "scanner-primary", "fingerprint": "b4ca43fa964932a6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sdk/python/src/openai_codex/async_client.py:268"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-24d443735275f6ee", "level": "note", "message": {"text": "Possibly dead Python function: request_with_retry_on_overload"}, "properties": {"repobilityId": "a2ea6550a01e133e", "scanner": "scanner-primary", "fingerprint": "24d443735275f6ee", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sdk/python/src/openai_codex/async_client.py:315"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7cc7823aabf9e1f4", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 sdk/typescript/tests/run.test.ts:773"}, "properties": {"repobilityId": "244f8e515469b920", "scanner": "scanner-primary", "fingerprint": "7cc7823aabf9e1f4", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-e04b4e058df01fe7", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 sdk/typescript/samples/structured_output.ts:22"}, "properties": {"repobilityId": "5918bbcad525f12c", "scanner": "scanner-primary", "fingerprint": "e04b4e058df01fe7", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-6e6908538b45f380", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 sdk/typescript/samples/basic_streaming.ts:17"}, "properties": {"repobilityId": "e5eee28089367543", "scanner": "scanner-primary", "fingerprint": "6e6908538b45f380", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-10320694a80b1113", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 sdk/typescript/samples/structured_output_zod.ts:19"}, "properties": {"repobilityId": "c805c1643987cd07", "scanner": "scanner-primary", "fingerprint": "10320694a80b1113", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-41b925ef6ba0de7b", "level": "warning", "message": {"text": "dynamic urllib use detected \u2014 codex-rs/scripts/write_model_compatibility_catalog.py:22"}, "properties": {"repobilityId": "e50d60b72e19703c", "scanner": "scanner-primary", "fingerprint": "41b925ef6ba0de7b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["semgrep", "security", "python"]}}, {"ruleId": "scanner-0576a1647d6b7c6e", "level": "warning", "message": {"text": "dynamic urllib use detected \u2014 codex-rs/scripts/write_provider_catalog.py:35"}, "properties": {"repobilityId": "ede2dea898975c8e", "scanner": "scanner-primary", "fingerprint": "0576a1647d6b7c6e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["semgrep", "security", "python"]}}, {"ruleId": "scanner-20203a76a8fb3150", "level": "warning", "message": {"text": "dynamic urllib use detected \u2014 codex-rs/scripts/write_provider_catalog.py:191"}, "properties": {"repobilityId": "ba9cb9e3e9ba662e", "scanner": "scanner-primary", "fingerprint": "20203a76a8fb3150", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["semgrep", "security", "python"]}}, {"ruleId": "scanner-da9d2d12885a4c19", "level": "warning", "message": {"text": "dynamic urllib use detected \u2014 codex-rs/skills/src/assets/samples/skill-installer/scripts/github_utils.py:16"}, "properties": {"repobilityId": "74a6ce2a1f2da3d5", "scanner": "scanner-primary", "fingerprint": "da9d2d12885a4c19", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["semgrep", "security", "python"]}}, {"ruleId": "scanner-c5c7423e95a82ee1", "level": "warning", "message": {"text": "dynamic urllib use detected \u2014 scripts/codex_package/dotslash.py:170"}, "properties": {"repobilityId": "b226efa7f070ef0e", "scanner": "scanner-primary", "fingerprint": "c5c7423e95a82ee1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["semgrep", "security", "python"]}}, {"ruleId": "scanner-d33709d0ccb2f0e4", "level": "warning", "message": {"text": "dynamic urllib use detected \u2014 scripts/codex_package/v8.py:175"}, "properties": {"repobilityId": "804d147ab384ff83", "scanner": "scanner-primary", "fingerprint": "d33709d0ccb2f0e4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["semgrep", "security", "python"]}}, {"ruleId": "scanner-4fdcc124ed1d5a11", "level": "warning", "message": {"text": "dynamic urllib use detected \u2014 sdk/python/_runtime_setup.py:154"}, "properties": {"repobilityId": "8bdc84bbb56448a7", "scanner": "scanner-primary", "fingerprint": "4fdcc124ed1d5a11", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["semgrep", "security", "python"]}}, {"ruleId": "scanner-824153fe8d59e096", "level": "warning", "message": {"text": "dynamic urllib use detected \u2014 sdk/python/_runtime_setup.py:182"}, "properties": {"repobilityId": "beb228cb3d89a3cd", "scanner": "scanner-primary", "fingerprint": "824153fe8d59e096", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["semgrep", "security", "python"]}}, {"ruleId": "scanner-fab56267c67ea208", "level": "warning", "message": {"text": "dynamic urllib use detected \u2014 sdk/python/_runtime_setup.py:214"}, "properties": {"repobilityId": "c8d7fa8d3527292d", "scanner": "scanner-primary", "fingerprint": "fab56267c67ea208", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["semgrep", "security", "python"]}}, {"ruleId": "scanner-edfba94b43f56e04", "level": "warning", "message": {"text": "GHSA-xhj4-vrgc-hr34: actix-http 3.11.2 \u2014 codex-rs/Cargo.lock"}, "properties": {"repobilityId": "28b58799100b1960", "scanner": "scanner-primary", "fingerprint": "edfba94b43f56e04", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-xhj4-vrgc-hr34"]}}, {"ruleId": "scanner-5357a2a3690a2685", "level": "warning", "message": {"text": "CVE-2026-50185: cmov 0.5.3 \u2014 codex-rs/Cargo.lock"}, "properties": {"repobilityId": "5986d5b65bcbdf89", "scanner": "scanner-primary", "fingerprint": "5357a2a3690a2685", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-50185"]}}, {"ruleId": "scanner-bf9bf1f56cc17cc3", "level": "error", "message": {"text": "CVE-2026-40034: gix 0.81.0 \u2014 codex-rs/Cargo.lock"}, "properties": {"repobilityId": "02fbf5484f8b88e2", "scanner": "scanner-primary", "fingerprint": "bf9bf1f56cc17cc3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-40034"]}}, {"ruleId": "scanner-3a488955e89a6206", "level": "error", "message": {"text": "GHSA-fr8x-3vfx-f45h: gix 0.81.0 \u2014 codex-rs/Cargo.lock"}, "properties": {"repobilityId": "1a901d10a7823996", "scanner": "scanner-primary", "fingerprint": "3a488955e89a6206", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-fr8x-3vfx-f45h"]}}, {"ruleId": "scanner-745db865016a7a0e", "level": "error", "message": {"text": "GHSA-p3hw-mv63-rf9w: gix 0.81.0 \u2014 codex-rs/Cargo.lock"}, "properties": {"repobilityId": "16b39c750bec7f97", "scanner": "scanner-primary", "fingerprint": "745db865016a7a0e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-p3hw-mv63-rf9w"]}}, {"ruleId": "scanner-7c8f63b97a4f059c", "level": "error", "message": {"text": "GHSA-pg4w-g64p-qwhj: gix 0.81.0 \u2014 codex-rs/Cargo.lock"}, "properties": {"repobilityId": "0bd011febe683dd8", "scanner": "scanner-primary", "fingerprint": "7c8f63b97a4f059c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-pg4w-g64p-qwhj"]}}, {"ruleId": "scanner-7e531cebb0fd11e1", "level": "error", "message": {"text": "CVE-2026-44471: gix-fs 0.19.2 \u2014 codex-rs/Cargo.lock"}, "properties": {"repobilityId": "071fa1d5eb287bbe", "scanner": "scanner-primary", "fingerprint": "7e531cebb0fd11e1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44471"]}}, {"ruleId": "scanner-8f1aac0741f67a61", "level": "error", "message": {"text": "GHSA-x494-mj8g-cj27: gix-pack 0.68.0 \u2014 codex-rs/Cargo.lock"}, "properties": {"repobilityId": "e5b7b956d9adb6b5", "scanner": "scanner-primary", "fingerprint": "8f1aac0741f67a61", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-x494-mj8g-cj27"]}}, {"ruleId": "scanner-b9f85814dd9d9600", "level": "warning", "message": {"text": "GHSA-9857-6mw7-fq2m: gix-transport 0.55.1 \u2014 codex-rs/Cargo.lock"}, "properties": {"repobilityId": "3df1bae89c959794", "scanner": "scanner-primary", "fingerprint": "b9f85814dd9d9600", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-9857-6mw7-fq2m"]}}, {"ruleId": "scanner-8a702e857511aec4", "level": "error", "message": {"text": "GHSA-p3hw-mv63-rf9w: gix-validate 0.11.0 \u2014 codex-rs/Cargo.lock"}, "properties": {"repobilityId": "7247a601e496cb2f", "scanner": "scanner-primary", "fingerprint": "8a702e857511aec4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-p3hw-mv63-rf9w"]}}, {"ruleId": "scanner-8124b3dbdb5e20af", "level": "error", "message": {"text": "GHSA-3v94-mw7p-v465: hickory-proto 0.25.2 \u2014 codex-rs/Cargo.lock"}, "properties": {"repobilityId": "91ff8b30c5590996", "scanner": "scanner-primary", "fingerprint": "8124b3dbdb5e20af", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-3v94-mw7p-v465"]}}, {"ruleId": "scanner-df1cbe7f37250bdd", "level": "warning", "message": {"text": "GHSA-q2qq-hmj6-3wpp: hickory-proto 0.25.2 \u2014 codex-rs/Cargo.lock"}, "properties": {"repobilityId": "0bb03bd8fadd0d02", "scanner": "scanner-primary", "fingerprint": "df1cbe7f37250bdd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-q2qq-hmj6-3wpp"]}}, {"ruleId": "scanner-2c28b4033a2cf01b", "level": "warning", "message": {"text": "CVE-2026-25537: jsonwebtoken 9.3.1 \u2014 codex-rs/Cargo.lock"}, "properties": {"repobilityId": "9669f5e53a94d429", "scanner": "scanner-primary", "fingerprint": "2c28b4033a2cf01b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-25537"]}}, {"ruleId": "scanner-93ff0b9f0fb0fde4", "level": "note", "message": {"text": "GHSA-rhfx-m35p-ff5j: lru 0.12.5 \u2014 codex-rs/Cargo.lock"}, "properties": {"repobilityId": "6e0b25651e600c17", "scanner": "scanner-primary", "fingerprint": "93ff0b9f0fb0fde4", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-rhfx-m35p-ff5j"]}}, {"ruleId": "scanner-6a33f7a39316cef4", "level": "error", "message": {"text": "CVE-2026-41676: openssl 0.10.75 \u2014 codex-rs/Cargo.lock"}, "properties": {"repobilityId": "97e43d486b4d64d3", "scanner": "scanner-primary", "fingerprint": "6a33f7a39316cef4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41676"]}}, {"ruleId": "scanner-45a528aaa4839307", "level": "error", "message": {"text": "CVE-2026-41678: openssl 0.10.75 \u2014 codex-rs/Cargo.lock"}, "properties": {"repobilityId": "525270d0c9769cb4", "scanner": "scanner-primary", "fingerprint": "45a528aaa4839307", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41678"]}}, {"ruleId": "scanner-25e964da0f446016", "level": "error", "message": {"text": "CVE-2026-41681: openssl 0.10.75 \u2014 codex-rs/Cargo.lock"}, "properties": {"repobilityId": "38253eac29e930bb", "scanner": "scanner-primary", "fingerprint": "25e964da0f446016", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41681"]}}, {"ruleId": "scanner-5d91e3442a5a5de5", "level": "error", "message": {"text": "CVE-2026-41898: openssl 0.10.75 \u2014 codex-rs/Cargo.lock"}, "properties": {"repobilityId": "e20109e8fb050a2f", "scanner": "scanner-primary", "fingerprint": "5d91e3442a5a5de5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41898"]}}, {"ruleId": "scanner-e8134905aeb744b3", "level": "error", "message": {"text": "CVE-2026-42327: openssl 0.10.75 \u2014 codex-rs/Cargo.lock"}, "properties": {"repobilityId": "4d7136eb402dd848", "scanner": "scanner-primary", "fingerprint": "e8134905aeb744b3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42327"]}}, {"ruleId": "scanner-796760b8068f816b", "level": "warning", "message": {"text": "CVE-2026-44662: openssl 0.10.75 \u2014 codex-rs/Cargo.lock"}, "properties": {"repobilityId": "3b1d974371a67a21", "scanner": "scanner-primary", "fingerprint": "796760b8068f816b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44662"]}}, {"ruleId": "scanner-d690420ff1928069", "level": "warning", "message": {"text": "CVE-2026-45784: openssl 0.10.75 \u2014 codex-rs/Cargo.lock"}, "properties": {"repobilityId": "534343ceebcbabaa", "scanner": "scanner-primary", "fingerprint": "d690420ff1928069", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45784"]}}, {"ruleId": "scanner-320909b867c12bd4", "level": "note", "message": {"text": "CVE-2026-41677: openssl 0.10.75 \u2014 codex-rs/Cargo.lock"}, "properties": {"repobilityId": "d1dc333e093a6140", "scanner": "scanner-primary", "fingerprint": "320909b867c12bd4", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41677"]}}, {"ruleId": "scanner-87fce9ea2110b293", "level": "warning", "message": {"text": "CVE-2026-48504: opentelemetry_sdk 0.31.0 \u2014 codex-rs/Cargo.lock"}, "properties": {"repobilityId": "c8d3f1a87aeb2f2a", "scanner": "scanner-primary", "fingerprint": "87fce9ea2110b293", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48504"]}}, {"ruleId": "scanner-ccbb7902c45942e4", "level": "warning", "message": {"text": "GHSA-3pv8-6f4r-ffg2: tar 0.4.45 \u2014 codex-rs/Cargo.lock"}, "properties": {"repobilityId": "dbd212d0b310bb37", "scanner": "scanner-primary", "fingerprint": "ccbb7902c45942e4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-3pv8-6f4r-ffg2"]}}, {"ruleId": "scanner-332497242ab356d0", "level": "warning", "message": {"text": "CVE-2026-33055: tar 0.4.44 \u2014 tools/argument-comment-lint/Cargo.lock"}, "properties": {"repobilityId": "0368414c7f6b9f15", "scanner": "scanner-primary", "fingerprint": "332497242ab356d0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33055"]}}, {"ruleId": "scanner-4e516440bd86adcb", "level": "warning", "message": {"text": "CVE-2026-33056: tar 0.4.44 \u2014 tools/argument-comment-lint/Cargo.lock"}, "properties": {"repobilityId": "4956bf29cea05942", "scanner": "scanner-primary", "fingerprint": "4e516440bd86adcb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33056"]}}, {"ruleId": "scanner-af4eee55e877591c", "level": "warning", "message": {"text": "GHSA-3pv8-6f4r-ffg2: tar 0.4.44 \u2014 tools/argument-comment-lint/Cargo.lock"}, "properties": {"repobilityId": "083bedf919e8bc2e", "scanner": "scanner-primary", "fingerprint": "af4eee55e877591c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-3pv8-6f4r-ffg2"]}}, {"ruleId": "scanner-c9c8522741c191fe", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 .devcontainer/Dockerfile"}, "properties": {"repobilityId": "b92ce3048e4ec526", "scanner": "scanner-primary", "fingerprint": "c9c8522741c191fe", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-09d170a096519c33", "level": "warning", "message": {"text": "DS-0013: 'RUN cd ...' to change directory \u2014 .devcontainer/Dockerfile.secure"}, "properties": {"repobilityId": "77484f7aec60b817", "scanner": "scanner-primary", "fingerprint": "09d170a096519c33", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-8c09d3f33cb5da6d", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 .devcontainer/Dockerfile.secure"}, "properties": {"repobilityId": "cbb548433ab514fa", "scanner": "scanner-primary", "fingerprint": "8c09d3f33cb5da6d", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-84bfcdf82eccd306", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 .github/workflows/Dockerfile.bazel"}, "properties": {"repobilityId": "b189f28a1f425cf7", "scanner": "scanner-primary", "fingerprint": "84bfcdf82eccd306", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-d63fb340484c2d1a", "level": "error", "message": {"text": "Secret leak: Asymmetric Private Key \u2014 codex-rs/agent-identity/src/lib.rs"}, "properties": {"repobilityId": "993ba1ca66f30a0c", "scanner": "scanner-primary", "fingerprint": "d63fb340484c2d1a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "secret"]}}, {"ruleId": "scanner-7cbbfa9a29b9d957", "level": "error", "message": {"text": "Secret leak: Asymmetric Private Key \u2014 codex-rs/login/src/auth/agent_identity.rs"}, "properties": {"repobilityId": "6228bc56eab4e199", "scanner": "scanner-primary", "fingerprint": "7cbbfa9a29b9d957", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "secret"]}}, {"ruleId": "scanner-70529cc568f8adfb", "level": "warning", "message": {"text": "Secret leak: JWT token \u2014 codex-rs/model-provider/src/auth.rs"}, "properties": {"repobilityId": "f112ef85b992fc92", "scanner": "scanner-primary", "fingerprint": "70529cc568f8adfb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "secret"]}}, {"ruleId": "scanner-2679282aa1c484b5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "properties": {"repobilityId": "27d579812e6be614", "scanner": "scanner-primary", "fingerprint": "2679282aa1c484b5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AGENTS.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2505e6df3ecf5685", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: codex-rs/skills/src/assets/samples/skill-installer/SKILL.md"}, "properties": {"repobilityId": "5f921d1802da2975", "scanner": "scanner-primary", "fingerprint": "2505e6df3ecf5685", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/skills/src/assets/samples/skill-installer/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9ba50bada784e634", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: codex-rs/skills/src/assets/samples/plugin-creator/SKILL.md"}, "properties": {"repobilityId": "997948bbf616d1e7", "scanner": "scanner-primary", "fingerprint": "9ba50bada784e634", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/skills/src/assets/samples/plugin-creator/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fb84f7ef946bd038", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: codex-rs/skills/src/assets/samples/qa-testing/SKILL.md"}, "properties": {"repobilityId": "85677e0f1a93b6a1", "scanner": "scanner-primary", "fingerprint": "fb84f7ef946bd038", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/skills/src/assets/samples/qa-testing/SKILL.md"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-2de8c44bf3a0cfd1", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .codex/skills/path-types/SKILL.md"}, "properties": {"repobilityId": "27da9ae694d2768b", "scanner": "scanner-primary", "fingerprint": "2de8c44bf3a0cfd1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "codex_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".codex/skills/path-types/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3595efb04a9f8c61", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .codex/skills/update-v8-version/SKILL.md"}, "properties": {"repobilityId": "429b9d413b33531c", "scanner": "scanner-primary", "fingerprint": "3595efb04a9f8c61", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "codex_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".codex/skills/update-v8-version/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-89692a10129d6f76", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .codex/skills/code-review/SKILL.md"}, "properties": {"repobilityId": "db2cb2ea9cd091dd", "scanner": "scanner-primary", "fingerprint": "89692a10129d6f76", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "codex_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".codex/skills/code-review/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6c7aaf7634412ce6", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .codex/skills/codex-issue-digest/agents/openai.yaml"}, "properties": {"repobilityId": "bbd3299861e79864", "scanner": "scanner-primary", "fingerprint": "6c7aaf7634412ce6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "codex_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".codex/skills/codex-issue-digest/agents/openai.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b2d2f1f893884742", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .codex/skills/remote-tests/SKILL.md"}, "properties": {"repobilityId": "0f089163ee341a7c", "scanner": "scanner-primary", "fingerprint": "b2d2f1f893884742", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "codex_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".codex/skills/remote-tests/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-83ca04991b5ad924", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .codex/skills/babysit-pr/SKILL.md"}, "properties": {"repobilityId": "bc644e0e5e8c26d0", "scanner": "scanner-primary", "fingerprint": "83ca04991b5ad924", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "codex_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".codex/skills/babysit-pr/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0d3263600289612c", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .codex/skills/babysit-pr/references/github-api-notes.md"}, "properties": {"repobilityId": "73efdb408ec1b131", "scanner": "scanner-primary", "fingerprint": "0d3263600289612c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "codex_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".codex/skills/babysit-pr/references/github-api-notes.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-05a0a8919130060d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .codex/skills/babysit-pr/references/heuristics.md"}, "properties": {"repobilityId": "7db28a08e2b0a9d7", "scanner": "scanner-primary", "fingerprint": "05a0a8919130060d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "codex_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".codex/skills/babysit-pr/references/heuristics.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a5758914f9faf4ef", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .codex/skills/babysit-pr/agents/openai.yaml"}, "properties": {"repobilityId": "e42663d6f8ff03cb", "scanner": "scanner-primary", "fingerprint": "a5758914f9faf4ef", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "codex_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".codex/skills/babysit-pr/agents/openai.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4a952517d41609e2", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .codex/skills/codex-pr-body/SKILL.md"}, "properties": {"repobilityId": "6614fdc9d943d93c", "scanner": "scanner-primary", "fingerprint": "4a952517d41609e2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "codex_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".codex/skills/codex-pr-body/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-06809e2945cfabfa", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in .codex/skills/babysit-pr/scripts/gh_pr_watch.py"}, "properties": {"repobilityId": "9f076734389cd509", "scanner": "scanner-primary", "fingerprint": "06809e2945cfabfa", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".codex/skills/babysit-pr/scripts/gh_pr_watch.py"}, "region": {"startLine": 116}}}]}, {"ruleId": "scanner-2b55920732728d2b", "level": "warning", "message": {"text": "SkillSpector LP3 (mcp-least-priv) in .codex/skills/babysit-pr/SKILL.md"}, "properties": {"repobilityId": "83bd61c864f4cb63", "scanner": "scanner-primary", "fingerprint": "2b55920732728d2b", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "mcp-least-priv", "LP3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".codex/skills/babysit-pr/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5ee482f6edf4ae27", "level": "warning", "message": {"text": "SkillSpector EA2 (excessive-agency) in .codex/skills/babysit-pr/SKILL.md"}, "properties": {"repobilityId": "ce3a9cc24f364b2b", "scanner": "scanner-primary", "fingerprint": "5ee482f6edf4ae27", "layer": "security", "severity": "medium", "confidence": 0.75, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".codex/skills/babysit-pr/SKILL.md"}, "region": {"startLine": 201}}}]}, {"ruleId": "scanner-e47adc07c9ff2fe1", "level": "error", "message": {"text": "SkillSpector OH1 (output-handling) in .codex/skills/babysit-pr/scripts/gh_pr_watch.py"}, "properties": {"repobilityId": "48b3994dff58e6bc", "scanner": "scanner-primary", "fingerprint": "e47adc07c9ff2fe1", "layer": "security", "severity": "high", "confidence": 0.95, "tags": ["skillspector", "mcp-skill", "output-handling", "OH1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".codex/skills/babysit-pr/scripts/gh_pr_watch.py"}, "region": {"startLine": 116}}}]}, {"ruleId": "scanner-b05550a98880ac53", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in .codex/skills/codex-bug/SKILL.md"}, "properties": {"repobilityId": "4793294b9c93de73", "scanner": "scanner-primary", "fingerprint": "b05550a98880ac53", "layer": "security", "severity": "medium", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".codex/skills/codex-bug/SKILL.md"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-d509a817ba1cff0e", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in .codex/skills/codex-issue-digest/scripts/collect_issue_digest.py"}, "properties": {"repobilityId": "04b8695a41973d12", "scanner": "scanner-primary", "fingerprint": "d509a817ba1cff0e", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".codex/skills/codex-issue-digest/scripts/collect_issue_digest.py"}, "region": {"startLine": 230}}}]}, {"ruleId": "scanner-6366747dc41e032b", "level": "warning", "message": {"text": "SkillSpector LP3 (mcp-least-priv) in .codex/skills/codex-issue-digest/SKILL.md"}, "properties": {"repobilityId": "bb74ef43106c9ca0", "scanner": "scanner-primary", "fingerprint": "6366747dc41e032b", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "mcp-least-priv", "LP3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".codex/skills/codex-issue-digest/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-31126f9ae289e9e7", "level": "error", "message": {"text": "SkillSpector OH1 (output-handling) in .codex/skills/codex-issue-digest/scripts/collect_issue_digest.py"}, "properties": {"repobilityId": "d58a454e7e86240e", "scanner": "scanner-primary", "fingerprint": "31126f9ae289e9e7", "layer": "security", "severity": "high", "confidence": 0.95, "tags": ["skillspector", "mcp-skill", "output-handling", "OH1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".codex/skills/codex-issue-digest/scripts/collect_issue_digest.py"}, "region": {"startLine": 230}}}]}, {"ruleId": "scanner-94dcca14283e2b12", "level": "note", "message": {"text": "SkillSpector EA3 (excessive-agency) in .codex/skills/codex-pr-body/SKILL.md"}, "properties": {"repobilityId": "0ee16d2f5b6cd941", "scanner": "scanner-primary", "fingerprint": "94dcca14283e2b12", "layer": "security", "severity": "low", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".codex/skills/codex-pr-body/SKILL.md"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-0491596da465f16a", "level": "note", "message": {"text": "SkillSpector AST7 (behavioral-ast) in codex-rs/skills/src/assets/samples/imagegen/scripts/image_gen.py"}, "properties": {"repobilityId": "18a601cbd7bd7e57", "scanner": "scanner-primary", "fingerprint": "0491596da465f16a", "layer": "security", "severity": "low", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST7", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/skills/src/assets/samples/imagegen/scripts/image_gen.py"}, "region": {"startLine": 512}}}]}, {"ruleId": "scanner-f49129265480f064", "level": "warning", "message": {"text": "SkillSpector LP3 (mcp-least-priv) in codex-rs/skills/src/assets/samples/imagegen/SKILL.md"}, "properties": {"repobilityId": "29794d0684f86cf0", "scanner": "scanner-primary", "fingerprint": "f49129265480f064", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "mcp-least-priv", "LP3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/skills/src/assets/samples/imagegen/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e4a6b8720bdf5b63", "level": "note", "message": {"text": "SkillSpector EA3 (excessive-agency) in codex-rs/skills/src/assets/samples/imagegen/LICENSE.txt"}, "properties": {"repobilityId": "783e275de04a2e12", "scanner": "scanner-primary", "fingerprint": "e4a6b8720bdf5b63", "layer": "security", "severity": "low", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/skills/src/assets/samples/imagegen/LICENSE.txt"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-91d77a4cd5f42dcf", "level": "warning", "message": {"text": "SkillSpector EA2 (excessive-agency) in codex-rs/skills/src/assets/samples/imagegen/SKILL.md"}, "properties": {"repobilityId": "a85ac6fc47ddf41c", "scanner": "scanner-primary", "fingerprint": "91d77a4cd5f42dcf", "layer": "security", "severity": "medium", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/skills/src/assets/samples/imagegen/SKILL.md"}, "region": {"startLine": 334}}}]}, {"ruleId": "scanner-656c2f67d22f8e30", "level": "error", "message": {"text": "SkillSpector P6 (prompt-injection) in codex-rs/skills/src/assets/samples/imagegen/scripts/image_gen.py"}, "properties": {"repobilityId": "de8e511451ec5822", "scanner": "scanner-primary", "fingerprint": "656c2f67d22f8e30", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "prompt-injection", "P6"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/skills/src/assets/samples/imagegen/scripts/image_gen.py"}, "region": {"startLine": 88}}}]}, {"ruleId": "scanner-13ac325451042f5c", "level": "error", "message": {"text": "SkillSpector TM1 (tool-misuse) in codex-rs/skills/src/assets/samples/imagegen/references/cli.md"}, "properties": {"repobilityId": "f0d7cc3ee13a0811", "scanner": "scanner-primary", "fingerprint": "13ac325451042f5c", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/skills/src/assets/samples/imagegen/references/cli.md"}, "region": {"startLine": 220}}}]}, {"ruleId": "scanner-abac3407d2f4a71a", "level": "warning", "message": {"text": "SkillSpector LP3 (mcp-least-priv) in codex-rs/skills/src/assets/samples/openai-docs/SKILL.md"}, "properties": {"repobilityId": "ba3df56d957ed89a", "scanner": "scanner-primary", "fingerprint": "abac3407d2f4a71a", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "mcp-least-priv", "LP3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/skills/src/assets/samples/openai-docs/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9f69b3f6204e4734", "level": "note", "message": {"text": "SkillSpector EA3 (excessive-agency) in codex-rs/skills/src/assets/samples/openai-docs/LICENSE.txt"}, "properties": {"repobilityId": "9fddf1e2fd190fa1", "scanner": "scanner-primary", "fingerprint": "9f69b3f6204e4734", "layer": "security", "severity": "low", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/skills/src/assets/samples/openai-docs/LICENSE.txt"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-bfc27b798ae0bd53", "level": "error", "message": {"text": "SkillSpector P6 (prompt-injection) in codex-rs/skills/src/assets/samples/openai-docs/references/upgrade-guide.md"}, "properties": {"repobilityId": "fc84e3ce56bf4995", "scanner": "scanner-primary", "fingerprint": "bfc27b798ae0bd53", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "prompt-injection", "P6"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/skills/src/assets/samples/openai-docs/references/upgrade-guide.md"}, "region": {"startLine": 61}}}]}, {"ruleId": "scanner-0b8c52f0e72fc361", "level": "warning", "message": {"text": "SkillSpector LP3 (mcp-least-priv) in codex-rs/skills/src/assets/samples/plugin-creator/SKILL.md"}, "properties": {"repobilityId": "52328531431d16bd", "scanner": "scanner-primary", "fingerprint": "0b8c52f0e72fc361", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "mcp-least-priv", "LP3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/skills/src/assets/samples/plugin-creator/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8ebedfad5a119bfa", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in codex-rs/skills/src/assets/samples/plugin-creator/SKILL.md"}, "properties": {"repobilityId": "c4c3c58758a0e3f3", "scanner": "scanner-primary", "fingerprint": "8ebedfad5a119bfa", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/skills/src/assets/samples/plugin-creator/SKILL.md"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-c01b655d87c362a0", "level": "error", "message": {"text": "SkillSpector RA1 (rogue-agent) in codex-rs/skills/src/assets/samples/plugin-creator/references/installing-and-updating.md"}, "properties": {"repobilityId": "22b79927abe5ecef", "scanner": "scanner-primary", "fingerprint": "c01b655d87c362a0", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/skills/src/assets/samples/plugin-creator/references/installing-and-updating.md"}, "region": {"startLine": 109}}}]}, {"ruleId": "scanner-14b14cd4e0f3ecf0", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in codex-rs/skills/src/assets/samples/plugin-creator/references/plugin-json-spec.md"}, "properties": {"repobilityId": "01fbe798702468e6", "scanner": "scanner-primary", "fingerprint": "14b14cd4e0f3ecf0", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/skills/src/assets/samples/plugin-creator/references/plugin-json-spec.md"}, "region": {"startLine": 192}}}]}, {"ruleId": "scanner-c276fe422266f9c1", "level": "error", "message": {"text": "SkillSpector RA1 (rogue-agent) in codex-rs/skills/src/assets/samples/plugin-creator/scripts/create_basic_plugin.py"}, "properties": {"repobilityId": "3ba5b42fa100513a", "scanner": "scanner-primary", "fingerprint": "c276fe422266f9c1", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/skills/src/assets/samples/plugin-creator/scripts/create_basic_plugin.py"}, "region": {"startLine": 253}}}]}, {"ruleId": "scanner-bdfb61d2f29d1cd7", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in codex-rs/skills/src/assets/samples/qa-testing/SKILL.md"}, "properties": {"repobilityId": "3267af05453775a3", "scanner": "scanner-primary", "fingerprint": "bdfb61d2f29d1cd7", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/skills/src/assets/samples/qa-testing/SKILL.md"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-879419c26e25e1ff", "level": "warning", "message": {"text": "SkillSpector LP3 (mcp-least-priv) in codex-rs/skills/src/assets/samples/skill-creator/SKILL.md"}, "properties": {"repobilityId": "8d225c989a874678", "scanner": "scanner-primary", "fingerprint": "879419c26e25e1ff", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "mcp-least-priv", "LP3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/skills/src/assets/samples/skill-creator/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0ae4dcc70aeccaaa", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in codex-rs/skills/src/assets/samples/skill-creator/references/openai_yaml.md"}, "properties": {"repobilityId": "9228550984f4d7f6", "scanner": "scanner-primary", "fingerprint": "0ae4dcc70aeccaaa", "layer": "security", "severity": "medium", "confidence": 0.5, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/skills/src/assets/samples/skill-creator/references/openai_yaml.md"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-0556c93948bd0c0e", "level": "note", "message": {"text": "SkillSpector EA3 (excessive-agency) in codex-rs/skills/src/assets/samples/skill-creator/license.txt"}, "properties": {"repobilityId": "0fc47314ff616864", "scanner": "scanner-primary", "fingerprint": "0556c93948bd0c0e", "layer": "security", "severity": "low", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/skills/src/assets/samples/skill-creator/license.txt"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-a8e837fd760b4f28", "level": "error", "message": {"text": "SkillSpector RA1 (rogue-agent) in codex-rs/skills/src/assets/samples/skill-creator/SKILL.md"}, "properties": {"repobilityId": "a9cea6d48c293d91", "scanner": "scanner-primary", "fingerprint": "a8e837fd760b4f28", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/skills/src/assets/samples/skill-creator/SKILL.md"}, "region": {"startLine": 230}}}]}, {"ruleId": "scanner-36b67c1580a81a30", "level": "warning", "message": {"text": "SkillSpector RA2 (rogue-agent) in codex-rs/skills/src/assets/samples/skill-creator/SKILL.md"}, "properties": {"repobilityId": "69c925f10410cabd", "scanner": "scanner-primary", "fingerprint": "36b67c1580a81a30", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/skills/src/assets/samples/skill-creator/SKILL.md"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-bf19e46d4c4ddfd7", "level": "error", "message": {"text": "SkillSpector RA1 (rogue-agent) in codex-rs/skills/src/assets/samples/skill-creator/scripts/init_skill.py"}, "properties": {"repobilityId": "27f177458985ba21", "scanner": "scanner-primary", "fingerprint": "bf19e46d4c4ddfd7", "layer": "security", "severity": "high", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "rogue-agent", "RA1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/skills/src/assets/samples/skill-creator/scripts/init_skill.py"}, "region": {"startLine": 319}}}]}, {"ruleId": "scanner-98b350008d03938e", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in codex-rs/skills/src/assets/samples/skill-installer/scripts/install-skill-from-github.py"}, "properties": {"repobilityId": "6a65334df027f222", "scanner": "scanner-primary", "fingerprint": "98b350008d03938e", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/skills/src/assets/samples/skill-installer/scripts/install-skill-from-github.py"}, "region": {"startLine": 100}}}]}, {"ruleId": "scanner-79faa5c273f0075c", "level": "warning", "message": {"text": "SkillSpector LP3 (mcp-least-priv) in codex-rs/skills/src/assets/samples/skill-installer/SKILL.md"}, "properties": {"repobilityId": "ada05cac8d4660e2", "scanner": "scanner-primary", "fingerprint": "79faa5c273f0075c", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "mcp-least-priv", "LP3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/skills/src/assets/samples/skill-installer/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-83ac2428a9e0c225", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in codex-rs/skills/src/assets/samples/skill-installer/scripts/github_utils.py"}, "properties": {"repobilityId": "ecda18196094a621", "scanner": "scanner-primary", "fingerprint": "83ac2428a9e0c225", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/skills/src/assets/samples/skill-installer/scripts/github_utils.py"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-4d59c3c308bdf412", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in codex-rs/skills/src/assets/samples/skill-installer/scripts/github_utils.py"}, "properties": {"repobilityId": "1e27b6b332deb511", "scanner": "scanner-primary", "fingerprint": "4d59c3c308bdf412", "layer": "security", "severity": "high", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/skills/src/assets/samples/skill-installer/scripts/github_utils.py"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-7c1ab73c2f9941da", "level": "note", "message": {"text": "SkillSpector EA3 (excessive-agency) in codex-rs/skills/src/assets/samples/skill-installer/LICENSE.txt"}, "properties": {"repobilityId": "da28c1c1ec2aeecb", "scanner": "scanner-primary", "fingerprint": "7c1ab73c2f9941da", "layer": "security", "severity": "low", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/skills/src/assets/samples/skill-installer/LICENSE.txt"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-e637c415447867e4", "level": "none", "message": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "properties": {"repobilityId": "1936f198ff5212bf", "scanner": "scanner-primary", "fingerprint": "e637c415447867e4", "layer": "security", "severity": "info", "confidence": 1.0, "tags": ["skillspector", "mcp-skill", "llm-advisory", "ai-coder"]}}, {"ruleId": "scanner-840da370e9e2f1b4", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: ubuntu:24.04"}, "properties": {"repobilityId": "9bac5bf48eb9686e", "scanner": "scanner-primary", "fingerprint": "840da370e9e2f1b4", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".devcontainer/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-42222223b4a3450e", "level": "error", "message": {"text": "Dockerfile pipes a remote installer into a shell"}, "properties": {"repobilityId": "5599c036f670e547", "scanner": "scanner-primary", "fingerprint": "42222223b4a3450e", "layer": "hardware", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "docker", "remote-installer"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".devcontainer/Dockerfile"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-2438b6d759fe57fe", "level": "error", "message": {"text": "Possible secret in codex-rs/login/src/auth/bedrock_api_key_tests.rs"}, "properties": {"repobilityId": "ab9f2953da3488a5", "scanner": "scanner-primary", "fingerprint": "2438b6d759fe57fe", "layer": "security", "severity": "high", "confidence": 0.72, "tags": ["secrets", "generic_api_key"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/login/src/auth/bedrock_api_key_tests.rs"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-75d8946ec4330ae5", "level": "error", "message": {"text": "Possible secret in codex-rs/model-provider/src/auth.rs"}, "properties": {"repobilityId": "6ebc4fbb88e82c6f", "scanner": "scanner-primary", "fingerprint": "75d8946ec4330ae5", "layer": "security", "severity": "high", "confidence": 0.72, "tags": ["secrets", "generic_api_key"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/model-provider/src/auth.rs"}, "region": {"startLine": 529}}}]}, {"ruleId": "scanner-59688bbaba0fddd4", "level": "error", "message": {"text": "Possible secret in codex-rs/model-provider/src/provider.rs"}, "properties": {"repobilityId": "ca687eb0abbc2241", "scanner": "scanner-primary", "fingerprint": "59688bbaba0fddd4", "layer": "security", "severity": "high", "confidence": 0.72, "tags": ["secrets", "generic_api_key"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/model-provider/src/provider.rs"}, "region": {"startLine": 484}}}]}, {"ruleId": "scanner-b293927949628d80", "level": "error", "message": {"text": "Possible secret in codex-rs/model-provider/src/amazon_bedrock/mod.rs"}, "properties": {"repobilityId": "fc16b7ce2d82118c", "scanner": "scanner-primary", "fingerprint": "b293927949628d80", "layer": "security", "severity": "high", "confidence": 0.72, "tags": ["secrets", "generic_api_key"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/model-provider/src/amazon_bedrock/mod.rs"}, "region": {"startLine": 207}}}]}, {"ruleId": "scanner-c85fe51e21163e5c", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in codex-rs/core/src/exec.rs:534"}, "properties": {"repobilityId": "37bc38ab56fdd3e3", "scanner": "scanner-primary", "fingerprint": "c85fe51e21163e5c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/core/src/exec.rs"}, "region": {"startLine": 534}}}]}, {"ruleId": "scanner-629fce79f9e3c389", "level": "error", "message": {"text": "Possible secret in codex-rs/network-proxy/src/credential_broker_tests.rs"}, "properties": {"repobilityId": "cbf6cc57d55d31e1", "scanner": "scanner-primary", "fingerprint": "629fce79f9e3c389", "layer": "security", "severity": "critical", "confidence": 0.99, "tags": ["secrets", "github_token", "high-confidence-secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/network-proxy/src/credential_broker_tests.rs"}, "region": {"startLine": 119}}}]}, {"ruleId": "scanner-c2c0ceb01b8d3fda", "level": "error", "message": {"text": "Possible secret in codex-rs/network-proxy/src/credential_broker_tests.rs"}, "properties": {"repobilityId": "4255e44a936150ec", "scanner": "scanner-primary", "fingerprint": "c2c0ceb01b8d3fda", "layer": "security", "severity": "high", "confidence": 0.72, "tags": ["secrets", "generic_api_key"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/network-proxy/src/credential_broker_tests.rs"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-91365f42cbf98805", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "f35b12f8620c31b7", "scanner": "scanner-primary", "fingerprint": "91365f42cbf98805", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/python-sdk-release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-33eb15dac68c8444", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "5b521b66aafffcb6", "scanner": "scanner-primary", "fingerprint": "33eb15dac68c8444", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rust-release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d746558daab2a5bb", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "0a07e26fb5f82681", "scanner": "scanner-primary", "fingerprint": "d746558daab2a5bb", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rust-release-prepare.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-05ddeaa1c2f3b7bf", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "262b28d74dd3125e", "scanner": "scanner-primary", "fingerprint": "05ddeaa1c2f3b7bf", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rusty-v8-release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f3ea3764a6611f52", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "218171c0c7955bed", "scanner": "scanner-primary", "fingerprint": "f3ea3764a6611f52", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/rust-release-publish-existing.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3eddcf26b2d6baf1", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "d98cdcdd295b1f16", "scanner": "scanner-primary", "fingerprint": "3eddcf26b2d6baf1", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/python-runtime-release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ca1eab671c04e8e6", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "64b034519f4ff2d7", "scanner": "scanner-primary", "fingerprint": "ca1eab671c04e8e6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sdk/typescript/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d3bb24d9d2019e82", "level": "note", "message": {"text": "Very large file: codex-rs/cloud-tasks/src/lib.rs (2402 lines)"}, "properties": {"repobilityId": "1ae0f45e232fd8cf", "scanner": "scanner-primary", "fingerprint": "d3bb24d9d2019e82", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-392c4bbfb73994ee", "level": "note", "message": {"text": "Very large file: codex-rs/exec-server/src/relay.rs (1318 lines)"}, "properties": {"repobilityId": "f44c4d1a75ab7dd7", "scanner": "scanner-primary", "fingerprint": "392c4bbfb73994ee", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-bc7612bae6e0234d", "level": "note", "message": {"text": "Very large file: codex-rs/exec-server/src/client.rs (2444 lines)"}, "properties": {"repobilityId": "8ecabd4ce5621be1", "scanner": "scanner-primary", "fingerprint": "bc7612bae6e0234d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d554cf7ba37c4025", "level": "note", "message": {"text": "Very large file: codex-rs/state/src/runtime/goals.rs (1639 lines)"}, "properties": {"repobilityId": "5e717331867b90c0", "scanner": "scanner-primary", "fingerprint": "d554cf7ba37c4025", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3e09786d2f775ff0", "level": "note", "message": {"text": "Very large file: codex-rs/state/src/runtime/threads.rs (3083 lines)"}, "properties": {"repobilityId": "eab25969c394f7b7", "scanner": "scanner-primary", "fingerprint": "3e09786d2f775ff0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-719d260dcc68b196", "level": "note", "message": {"text": "Very large file: codex-rs/state/src/runtime/logs.rs (1859 lines)"}, "properties": {"repobilityId": "ea06719a9539f80d", "scanner": "scanner-primary", "fingerprint": "719d260dcc68b196", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5c16a209da132e28", "level": "note", "message": {"text": "Very large file: codex-rs/state/src/runtime/memories.rs (5290 lines)"}, "properties": {"repobilityId": "141e9d7f010d9144", "scanner": "scanner-primary", "fingerprint": "5c16a209da132e28", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1f9e977bd61c127f", "level": "note", "message": {"text": "Very large file: codex-rs/config/src/config_requirements.rs (3843 lines)"}, "properties": {"repobilityId": "e0f18647b41b6e9f", "scanner": "scanner-primary", "fingerprint": "1f9e977bd61c127f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b9b6f99659d1ef43", "level": "note", "message": {"text": "Very large file: codex-rs/config/src/loader/mod.rs (1570 lines)"}, "properties": {"repobilityId": "a7ca018482299e8c", "scanner": "scanner-primary", "fingerprint": "b9b6f99659d1ef43", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-68ac946a4bfc355d", "level": "note", "message": {"text": "Very large file: codex-rs/analytics/src/reducer.rs (2840 lines)"}, "properties": {"repobilityId": "75ed72ee9bf6a647", "scanner": "scanner-primary", "fingerprint": "68ac946a4bfc355d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-043bc63da96b5ba0", "level": "note", "message": {"text": "Very large file: codex-rs/analytics/src/analytics_client_tests.rs (4810 lines)"}, "properties": {"repobilityId": "31ee7fe96ce5435a", "scanner": "scanner-primary", "fingerprint": "043bc63da96b5ba0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5ed821b31f45ee1b", "level": "note", "message": {"text": "Very large file: codex-rs/acp-server/src/lib.rs (1367 lines)"}, "properties": {"repobilityId": "138381cccf5795d3", "scanner": "scanner-primary", "fingerprint": "5ed821b31f45ee1b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1eb4a73fd2d81ea7", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/keymap_setup.rs (1932 lines)"}, "properties": {"repobilityId": "8365ca32d1615ab1", "scanner": "scanner-primary", "fingerprint": "1eb4a73fd2d81ea7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-38ce50f15c82365a", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/lib.rs (3098 lines)"}, "properties": {"repobilityId": "251b73c09f382715", "scanner": "scanner-primary", "fingerprint": "38ce50f15c82365a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a57fa47c1d7b42c3", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/app_server_session.rs (2762 lines)"}, "properties": {"repobilityId": "4791998b0d8367da", "scanner": "scanner-primary", "fingerprint": "a57fa47c1d7b42c3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-04fa3b5e7c94e47c", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/chatwidget.rs (2081 lines)"}, "properties": {"repobilityId": "d979665cfd91aaa5", "scanner": "scanner-primary", "fingerprint": "04fa3b5e7c94e47c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-80d149e5e896563c", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/diff_render.rs (2534 lines)"}, "properties": {"repobilityId": "d11a9ca527987259", "scanner": "scanner-primary", "fingerprint": "80d149e5e896563c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-32b46f9060876162", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/markdown_render.rs (2774 lines)"}, "properties": {"repobilityId": "894630ed1ba9e521", "scanner": "scanner-primary", "fingerprint": "32b46f9060876162", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-63bb2ac7bf736fc1", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/markdown_render_tests.rs (1827 lines)"}, "properties": {"repobilityId": "eeee54b563823297", "scanner": "scanner-primary", "fingerprint": "63bb2ac7bf736fc1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9f3abbf0d166771c", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/keymap.rs (2980 lines)"}, "properties": {"repobilityId": "f2f7e5c1c6885deb", "scanner": "scanner-primary", "fingerprint": "9f3abbf0d166771c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1c9c0c8963768d24", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/wrapping.rs (1657 lines)"}, "properties": {"repobilityId": "0a0e27a0ab0f1d8e", "scanner": "scanner-primary", "fingerprint": "1c9c0c8963768d24", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-abbb72a38bb05d1f", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/app.rs (1390 lines)"}, "properties": {"repobilityId": "4fe9266c62ed09fc", "scanner": "scanner-primary", "fingerprint": "abbb72a38bb05d1f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-faa0c8efb7f43836", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/pager_overlay.rs (1570 lines)"}, "properties": {"repobilityId": "ff5761820e199513", "scanner": "scanner-primary", "fingerprint": "faa0c8efb7f43836", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f4e33dbbad8b21b7", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/resume_picker.rs (6351 lines)"}, "properties": {"repobilityId": "28f49ef78cf03ce6", "scanner": "scanner-primary", "fingerprint": "f4e33dbbad8b21b7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2bf28d45323eb4c5", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/bottom_pane/mcp_server_elicitation.rs (2732 lines)"}, "properties": {"repobilityId": "a5f4c29ccecded63", "scanner": "scanner-primary", "fingerprint": "2bf28d45323eb4c5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2c9722a173a73eda", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/bottom_pane/app_link_view.rs (1704 lines)"}, "properties": {"repobilityId": "0b84b77df42c31da", "scanner": "scanner-primary", "fingerprint": "2c9722a173a73eda", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-25b0ebbf95081c2a", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/bottom_pane/textarea.rs (3837 lines)"}, "properties": {"repobilityId": "52f3d56ac65b49ee", "scanner": "scanner-primary", "fingerprint": "25b0ebbf95081c2a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3fb759d81fe6783b", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/bottom_pane/approval_overlay.rs (2409 lines)"}, "properties": {"repobilityId": "a2671fe01513f141", "scanner": "scanner-primary", "fingerprint": "3fb759d81fe6783b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4d115e50dfc21a87", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/bottom_pane/hooks_browser_view.rs (1634 lines)"}, "properties": {"repobilityId": "894ed0605d336fb6", "scanner": "scanner-primary", "fingerprint": "4d115e50dfc21a87", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f93c405021855d2d", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/bottom_pane/mod.rs (3078 lines)"}, "properties": {"repobilityId": "9fee1f7714a0d118", "scanner": "scanner-primary", "fingerprint": "f93c405021855d2d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2f3d8b6d9323f309", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/bottom_pane/chat_composer.rs (11501 lines)"}, "properties": {"repobilityId": "11d57f751a75cf84", "scanner": "scanner-primary", "fingerprint": "2f3d8b6d9323f309", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-af9c6d36f047cef3", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/bottom_pane/chat_composer_history.rs (1505 lines)"}, "properties": {"repobilityId": "50d29f30b8b6e50f", "scanner": "scanner-primary", "fingerprint": "af9c6d36f047cef3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-af35014efdc0c376", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/bottom_pane/footer.rs (2077 lines)"}, "properties": {"repobilityId": "1371e689ede55268", "scanner": "scanner-primary", "fingerprint": "af35014efdc0c376", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-68b71a9ce6340e84", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/bottom_pane/list_selection_view.rs (2840 lines)"}, "properties": {"repobilityId": "05c3b8528e58c89f", "scanner": "scanner-primary", "fingerprint": "68b71a9ce6340e84", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e65e2d89f9e51868", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/bottom_pane/request_user_input/mod.rs (3755 lines)"}, "properties": {"repobilityId": "b45b52798e3571cd", "scanner": "scanner-primary", "fingerprint": "e65e2d89f9e51868", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-851fb0e826a3b22b", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/history_cell/tests.rs (2738 lines)"}, "properties": {"repobilityId": "5be0478b7cd362ca", "scanner": "scanner-primary", "fingerprint": "851fb0e826a3b22b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c93f50787aa076a9", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/chatwidget/plugin_catalog.rs (2065 lines)"}, "properties": {"repobilityId": "208e4df103807c7e", "scanner": "scanner-primary", "fingerprint": "c93f50787aa076a9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-aba2b59793727ff0", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/chatwidget/model_popups.rs (1370 lines)"}, "properties": {"repobilityId": "9de7a17ebd4de3fb", "scanner": "scanner-primary", "fingerprint": "aba2b59793727ff0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5bb37db5f25719ce", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/chatwidget/tests/status_and_layout.rs (4200 lines)"}, "properties": {"repobilityId": "0a09dfece5871c66", "scanner": "scanner-primary", "fingerprint": "5bb37db5f25719ce", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-afe68eb9728bf154", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/chatwidget/tests/composer_submission.rs (1499 lines)"}, "properties": {"repobilityId": "3eefbdd47b66f716", "scanner": "scanner-primary", "fingerprint": "afe68eb9728bf154", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-44f319da860383e9", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/chatwidget/tests/slash_commands.rs (3021 lines)"}, "properties": {"repobilityId": "cf1ef89ee632edc4", "scanner": "scanner-primary", "fingerprint": "44f319da860383e9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-eb47fa22282a9ee4", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/chatwidget/tests/popups_and_settings.rs (3881 lines)"}, "properties": {"repobilityId": "6f5234b9939e78f9", "scanner": "scanner-primary", "fingerprint": "eb47fa22282a9ee4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-bdbc9c103a53fbed", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/chatwidget/tests/exec_flow.rs (1748 lines)"}, "properties": {"repobilityId": "1b25fbe334c7910c", "scanner": "scanner-primary", "fingerprint": "bdbc9c103a53fbed", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-82af0770431a4826", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/chatwidget/tests/helpers.rs (1691 lines)"}, "properties": {"repobilityId": "2911d2712493c8d6", "scanner": "scanner-primary", "fingerprint": "82af0770431a4826", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-89b7fb10eca02c43", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/chatwidget/tests/plan_mode.rs (1708 lines)"}, "properties": {"repobilityId": "3e1914b047dc6daa", "scanner": "scanner-primary", "fingerprint": "89b7fb10eca02c43", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-96b95fba5a031431", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/chatwidget/tests/review_mode.rs (1477 lines)"}, "properties": {"repobilityId": "b85c860bb8740d40", "scanner": "scanner-primary", "fingerprint": "96b95fba5a031431", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-100ad1f188f0f8dc", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/app/event_dispatch.rs (2816 lines)"}, "properties": {"repobilityId": "0e69c77efe2caef9", "scanner": "scanner-primary", "fingerprint": "100ad1f188f0f8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-fdaab5eaf298412c", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/app/config_persistence.rs (1743 lines)"}, "properties": {"repobilityId": "e2664ffaeb0e43a8", "scanner": "scanner-primary", "fingerprint": "fdaab5eaf298412c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-fbc23b73bb913655", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/app/background_requests.rs (1552 lines)"}, "properties": {"repobilityId": "68eb3c934210b3e2", "scanner": "scanner-primary", "fingerprint": "fbc23b73bb913655", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0e23737a7395ebe6", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/app/tests.rs (6277 lines)"}, "properties": {"repobilityId": "d51d67819bc3e263", "scanner": "scanner-primary", "fingerprint": "0e23737a7395ebe6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3063a856878e80bb", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/app/thread_routing.rs (1655 lines)"}, "properties": {"repobilityId": "ad8a52b3cdeae86f", "scanner": "scanner-primary", "fingerprint": "3063a856878e80bb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-61cdc7094b5b59a6", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/status/tests.rs (2038 lines)"}, "properties": {"repobilityId": "a53f7e71c52d4b53", "scanner": "scanner-primary", "fingerprint": "61cdc7094b5b59a6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-dce468a5210cd710", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/onboarding/auth.rs (1410 lines)"}, "properties": {"repobilityId": "d2d4a059bbc5691b", "scanner": "scanner-primary", "fingerprint": "dce468a5210cd710", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-aac120c7430f7903", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/streaming/controller.rs (1922 lines)"}, "properties": {"repobilityId": "b54be781dd96cc5b", "scanner": "scanner-primary", "fingerprint": "aac120c7430f7903", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5029e9eddb7a7d5a", "level": "note", "message": {"text": "Very large file: codex-rs/tui/src/render/highlight.rs (1567 lines)"}, "properties": {"repobilityId": "7360d9967d754834", "scanner": "scanner-primary", "fingerprint": "5029e9eddb7a7d5a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c1413bc08f5cd1cf", "level": "note", "message": {"text": "Very large file: codex-rs/login/src/auth/manager.rs (2622 lines)"}, "properties": {"repobilityId": "7dbaf42666671480", "scanner": "scanner-primary", "fingerprint": "c1413bc08f5cd1cf", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-36ef2d30f186b43a", "level": "note", "message": {"text": "Very large file: codex-rs/login/src/auth/auth_tests.rs (2313 lines)"}, "properties": {"repobilityId": "b493dcd9d6a76dc3", "scanner": "scanner-primary", "fingerprint": "36ef2d30f186b43a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e28b0c7494e91356", "level": "note", "message": {"text": "Very large file: codex-rs/chat-wire-compat/src/request.rs (1502 lines)"}, "properties": {"repobilityId": "1f1c5fd73d9d326a", "scanner": "scanner-primary", "fingerprint": "e28b0c7494e91356", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a357f17d1ce6efb7", "level": "note", "message": {"text": "Very large file: codex-rs/windows-sandbox-rs/src/setup.rs (1955 lines)"}, "properties": {"repobilityId": "c9885087314808d6", "scanner": "scanner-primary", "fingerprint": "a357f17d1ce6efb7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9bae5bace3cae7f2", "level": "note", "message": {"text": "Very large file: codex-rs/cli/src/doctor.rs (4269 lines)"}, "properties": {"repobilityId": "6e648b01511c0f80", "scanner": "scanner-primary", "fingerprint": "9bae5bace3cae7f2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-216004ce49e91e8b", "level": "note", "message": {"text": "Very large file: codex-rs/cli/src/main.rs (4145 lines)"}, "properties": {"repobilityId": "a3af453ceb2855ae", "scanner": "scanner-primary", "fingerprint": "216004ce49e91e8b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-261acd9bbc8dbc2c", "level": "note", "message": {"text": "Very large file: codex-rs/cli/src/doctor/output.rs (1705 lines)"}, "properties": {"repobilityId": "c7cff86bd2ff40a1", "scanner": "scanner-primary", "fingerprint": "261acd9bbc8dbc2c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6942a22be005c725", "level": "note", "message": {"text": "Very large file: codex-rs/thread-store/src/local/update_thread_metadata.rs (1853 lines)"}, "properties": {"repobilityId": "dabe5aef73eaecb2", "scanner": "scanner-primary", "fingerprint": "6942a22be005c725", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f793316ce47443ec", "level": "note", "message": {"text": "Very large file: codex-rs/thread-store/src/local/read_thread.rs (1366 lines)"}, "properties": {"repobilityId": "4895776e3bca44e2", "scanner": "scanner-primary", "fingerprint": "f793316ce47443ec", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5e18946247e2344f", "level": "note", "message": {"text": "Very large file: codex-rs/linux-sandbox/src/linux_run_main.rs (1470 lines)"}, "properties": {"repobilityId": "40937faef8de94af", "scanner": "scanner-primary", "fingerprint": "5e18946247e2344f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2a1b09b9ae3840d9", "level": "note", "message": {"text": "Very large file: codex-rs/linux-sandbox/src/bwrap.rs (2707 lines)"}, "properties": {"repobilityId": "fa6437350f7107a9", "scanner": "scanner-primary", "fingerprint": "2a1b09b9ae3840d9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d1c17f19847c1536", "level": "note", "message": {"text": "Very large file: codex-rs/core-skills/src/render.rs (1574 lines)"}, "properties": {"repobilityId": "a45fd91e644ba831", "scanner": "scanner-primary", "fingerprint": "d1c17f19847c1536", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-81084d02d15e7b11", "level": "note", "message": {"text": "Very large file: codex-rs/core-skills/src/loader_tests.rs (2438 lines)"}, "properties": {"repobilityId": "40eb961a957f229e", "scanner": "scanner-primary", "fingerprint": "81084d02d15e7b11", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f2fddf67fceea149", "level": "note", "message": {"text": "Very large file: codex-rs/code-mode/src/remote_session/connection/driver_tests.rs (1514 lines)"}, "properties": {"repobilityId": "0f33d5c3c3de6162", "scanner": "scanner-primary", "fingerprint": "f2fddf67fceea149", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c590562a3c2ad21a", "level": "note", "message": {"text": "Very large file: codex-rs/shell-command/src/parse_command.rs (2530 lines)"}, "properties": {"repobilityId": "deaa8df31cf48cc2", "scanner": "scanner-primary", "fingerprint": "c590562a3c2ad21a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e8ebafdcd6437b65", "level": "note", "message": {"text": "Very large file: codex-rs/codex-mcp/src/connection_manager_tests.rs (1766 lines)"}, "properties": {"repobilityId": "2e7aff4430aa60d9", "scanner": "scanner-primary", "fingerprint": "e8ebafdcd6437b65", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-bf713aa77a703d9c", "level": "note", "message": {"text": "Very large file: codex-rs/app-server-client/src/lib.rs (2377 lines)"}, "properties": {"repobilityId": "9bc168477812f7fd", "scanner": "scanner-primary", "fingerprint": "bf713aa77a703d9c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1a70916bb67a7a9b", "level": "note", "message": {"text": "Very large file: codex-rs/sandboxing/src/seatbelt_tests.rs (1450 lines)"}, "properties": {"repobilityId": "e8a529a4804f1056", "scanner": "scanner-primary", "fingerprint": "1a70916bb67a7a9b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e4b61e037c19469e", "level": "note", "message": {"text": "Very large file: codex-rs/hooks/src/engine/mod_tests.rs (1508 lines)"}, "properties": {"repobilityId": "69b6a1fc19747c04", "scanner": "scanner-primary", "fingerprint": "e4b61e037c19469e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-186be46a2bed0146", "level": "note", "message": {"text": "Very large file: codex-rs/exec/tests/event_processor_with_json_output.rs (1665 lines)"}, "properties": {"repobilityId": "b2f65675bf1695ca", "scanner": "scanner-primary", "fingerprint": "186be46a2bed0146", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-8eee14f95a7d83f5", "level": "note", "message": {"text": "Very large file: codex-rs/exec/src/lib.rs (2085 lines)"}, "properties": {"repobilityId": "219c4e382c0f3d6f", "scanner": "scanner-primary", "fingerprint": "8eee14f95a7d83f5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d031e87b0e71884f", "level": "note", "message": {"text": "Very large file: codex-rs/tools/src/json_schema_tests.rs (2049 lines)"}, "properties": {"repobilityId": "c1402efb687c1b49", "scanner": "scanner-primary", "fingerprint": "d031e87b0e71884f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-38568324a4fbaca6", "level": "note", "message": {"text": "Very large file: codex-rs/app-server/tests/common/test_app_server.rs (1954 lines)"}, "properties": {"repobilityId": "b2fe17317953d4af", "scanner": "scanner-primary", "fingerprint": "38568324a4fbaca6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-86977b5d1b16912f", "level": "note", "message": {"text": "Very large file: codex-rs/app-server/tests/suite/v2/plugin_share.rs (1514 lines)"}, "properties": {"repobilityId": "bb5c5ad98ac3c9a4", "scanner": "scanner-primary", "fingerprint": "86977b5d1b16912f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-8f470c5835a9c09e", "level": "note", "message": {"text": "Very large file: codex-rs/app-server/tests/suite/v2/app_list.rs (1918 lines)"}, "properties": {"repobilityId": "dd70c74989a95819", "scanner": "scanner-primary", "fingerprint": "8f470c5835a9c09e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea07ddd32745edfe", "level": "note", "message": {"text": "Very large file: codex-rs/app-server/tests/suite/v2/thread_start.rs (1748 lines)"}, "properties": {"repobilityId": "952f348b084a120f", "scanner": "scanner-primary", "fingerprint": "ea07ddd32745edfe", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-dc15cfa577c906af", "level": "note", "message": {"text": "Very large file: codex-rs/app-server/tests/suite/v2/thread_read.rs (1653 lines)"}, "properties": {"repobilityId": "57653d2a0a1f15b9", "scanner": "scanner-primary", "fingerprint": "dc15cfa577c906af", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3b09b9904ba7cd29", "level": "note", "message": {"text": "Very large file: codex-rs/app-server/tests/suite/v2/plugin_install.rs (2645 lines)"}, "properties": {"repobilityId": "233533d7d41851db", "scanner": "scanner-primary", "fingerprint": "3b09b9904ba7cd29", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ddc63ce51b57e363", "level": "note", "message": {"text": "Very large file: codex-rs/app-server/tests/suite/v2/plugin_list.rs (4343 lines)"}, "properties": {"repobilityId": "6f5354b9b09b16c4", "scanner": "scanner-primary", "fingerprint": "ddc63ce51b57e363", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ad3f089eb65ab604", "level": "note", "message": {"text": "Very large file: codex-rs/app-server/tests/suite/v2/realtime_conversation.rs (3183 lines)"}, "properties": {"repobilityId": "8ebb3e1b6d183358", "scanner": "scanner-primary", "fingerprint": "ad3f089eb65ab604", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ec648c7ae2338f51", "level": "note", "message": {"text": "Very large file: codex-rs/app-server/tests/suite/v2/thread_resume.rs (4466 lines)"}, "properties": {"repobilityId": "424327ac60b1dd8e", "scanner": "scanner-primary", "fingerprint": "ec648c7ae2338f51", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-96ed9d98b20bc374", "level": "note", "message": {"text": "Very large file: codex-rs/app-server/tests/suite/v2/thread_list.rs (2282 lines)"}, "properties": {"repobilityId": "82c93b29562adb65", "scanner": "scanner-primary", "fingerprint": "96ed9d98b20bc374", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7a7b58edbab9f7b3", "level": "note", "message": {"text": "Very large file: codex-rs/app-server/tests/suite/v2/external_agent_config.rs (1506 lines)"}, "properties": {"repobilityId": "098ed4110325ce0d", "scanner": "scanner-primary", "fingerprint": "7a7b58edbab9f7b3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a58255cdef733f54", "level": "note", "message": {"text": "Very large file: codex-rs/app-server/tests/suite/v2/turn_start.rs (4677 lines)"}, "properties": {"repobilityId": "86d43a3d08c88d64", "scanner": "scanner-primary", "fingerprint": "a58255cdef733f54", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6cc031005bcd60c4", "level": "note", "message": {"text": "Very large file: codex-rs/app-server/tests/suite/v2/plugin_read.rs (2296 lines)"}, "properties": {"repobilityId": "19cb9747ad184116", "scanner": "scanner-primary", "fingerprint": "6cc031005bcd60c4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-af3dd284891ef9fe", "level": "note", "message": {"text": "Very large file: codex-rs/app-server/tests/suite/v2/account.rs (2183 lines)"}, "properties": {"repobilityId": "5d55811e2d44d8cf", "scanner": "scanner-primary", "fingerprint": "af3dd284891ef9fe", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2564ac53dd047037", "level": "note", "message": {"text": "Very large file: codex-rs/app-server/src/lib.rs (1413 lines)"}, "properties": {"repobilityId": "ec17919a5c6da906", "scanner": "scanner-primary", "fingerprint": "2564ac53dd047037", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f96149aac138298b", "level": "note", "message": {"text": "Very large file: codex-rs/app-server/src/message_processor.rs (1465 lines)"}, "properties": {"repobilityId": "a2fff2d32a65c614", "scanner": "scanner-primary", "fingerprint": "f96149aac138298b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a41ff08af18b9ac6", "level": "note", "message": {"text": "Very large file: codex-rs/app-server/src/bespoke_event_handling.rs (3947 lines)"}, "properties": {"repobilityId": "ba4d3e5a8e0d79ea", "scanner": "scanner-primary", "fingerprint": "a41ff08af18b9ac6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6f94ff7d01859fa5", "level": "note", "message": {"text": "Very large file: codex-rs/app-server/src/outgoing_message.rs (1389 lines)"}, "properties": {"repobilityId": "889ae2908e665636", "scanner": "scanner-primary", "fingerprint": "6f94ff7d01859fa5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5959d89bb444e2a7", "level": "note", "message": {"text": "Very large file: codex-rs/app-server/src/config/external_agent_config_tests.rs (2796 lines)"}, "properties": {"repobilityId": "e98bdc06367aaa90", "scanner": "scanner-primary", "fingerprint": "5959d89bb444e2a7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-47450589b0170e8c", "level": "note", "message": {"text": "Very large file: codex-rs/app-server/src/config/external_agent_config.rs (1985 lines)"}, "properties": {"repobilityId": "9d1193fc305c2ccb", "scanner": "scanner-primary", "fingerprint": "47450589b0170e8c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f485c033676e4323", "level": "note", "message": {"text": "Very large file: codex-rs/app-server/src/request_processors/thread_processor.rs (4613 lines)"}, "properties": {"repobilityId": "2f9dbe6a1f066208", "scanner": "scanner-primary", "fingerprint": "f485c033676e4323", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-efe682c113eea181", "level": "note", "message": {"text": "Very large file: codex-rs/app-server/src/request_processors/turn_processor.rs (1457 lines)"}, "properties": {"repobilityId": "bfe158bd57f74e6f", "scanner": "scanner-primary", "fingerprint": "efe682c113eea181", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c2a7a1575b12ebdf", "level": "note", "message": {"text": "Very large file: codex-rs/app-server/src/request_processors/thread_processor_tests.rs (1513 lines)"}, "properties": {"repobilityId": "b033e4c93b7b9e46", "scanner": "scanner-primary", "fingerprint": "c2a7a1575b12ebdf", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7d6be6569d3b7c50", "level": "note", "message": {"text": "Very large file: codex-rs/app-server/src/request_processors/plugins.rs (2396 lines)"}, "properties": {"repobilityId": "4836aa3410f2b1cc", "scanner": "scanner-primary", "fingerprint": "7d6be6569d3b7c50", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-29f4c6724f932d1f", "level": "note", "message": {"text": "Very large file: codex-rs/core/tests/common/responses.rs (1738 lines)"}, "properties": {"repobilityId": "54a7ae8e211f8e24", "scanner": "scanner-primary", "fingerprint": "29f4c6724f932d1f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5e802484654f3d5a", "level": "note", "message": {"text": "Very large file: codex-rs/core/tests/suite/approvals.rs (3937 lines)"}, "properties": {"repobilityId": "f2930fb164c6ca1c", "scanner": "scanner-primary", "fingerprint": "5e802484654f3d5a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e441d95022d323b8", "level": "note", "message": {"text": "Very large file: codex-rs/core/tests/suite/rmcp_client.rs (3108 lines)"}, "properties": {"repobilityId": "cd76985fe88d8340", "scanner": "scanner-primary", "fingerprint": "e441d95022d323b8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-68569e23e427c67c", "level": "note", "message": {"text": "Very large file: codex-rs/core/tests/suite/apply_patch_cli.rs (1957 lines)"}, "properties": {"repobilityId": "89c039a0997a33bb", "scanner": "scanner-primary", "fingerprint": "68569e23e427c67c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0cfadb9e5f25eb81", "level": "note", "message": {"text": "Very large file: codex-rs/core/tests/suite/code_mode.rs (4015 lines)"}, "properties": {"repobilityId": "c3109526e9a8363a", "scanner": "scanner-primary", "fingerprint": "0cfadb9e5f25eb81", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9cdbab814c5322c5", "level": "note", "message": {"text": "Very large file: codex-rs/core/tests/suite/unified_exec.rs (3549 lines)"}, "properties": {"repobilityId": "ce21d39c6a45513d", "scanner": "scanner-primary", "fingerprint": "9cdbab814c5322c5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9764cbac48a5b20a", "level": "note", "message": {"text": "Very large file: codex-rs/core/tests/suite/realtime_conversation.rs (4315 lines)"}, "properties": {"repobilityId": "d6cb36375dbe03cb", "scanner": "scanner-primary", "fingerprint": "9764cbac48a5b20a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-951437223e6f8592", "level": "note", "message": {"text": "Very large file: codex-rs/core/tests/suite/remote_env.rs (1975 lines)"}, "properties": {"repobilityId": "dac80709684f7321", "scanner": "scanner-primary", "fingerprint": "951437223e6f8592", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-185bada439ecc67b", "level": "note", "message": {"text": "Very large file: codex-rs/core/tests/suite/client_websockets.rs (2444 lines)"}, "properties": {"repobilityId": "5b52800b32f5c00a", "scanner": "scanner-primary", "fingerprint": "185bada439ecc67b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-dee0be6ff4743f2d", "level": "note", "message": {"text": "Very large file: codex-rs/core/tests/suite/otel.rs (1712 lines)"}, "properties": {"repobilityId": "f55eb7ae0633aac0", "scanner": "scanner-primary", "fingerprint": "dee0be6ff4743f2d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d1bddd3fc7e92d87", "level": "note", "message": {"text": "Very large file: codex-rs/core/tests/suite/subagent_notifications.rs (1536 lines)"}, "properties": {"repobilityId": "76c3d3937490d501", "scanner": "scanner-primary", "fingerprint": "d1bddd3fc7e92d87", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-547f629242bebbfd", "level": "note", "message": {"text": "Very large file: codex-rs/core/tests/suite/search_tool.rs (1621 lines)"}, "properties": {"repobilityId": "478a75cc11a07c8c", "scanner": "scanner-primary", "fingerprint": "547f629242bebbfd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-df6caddf9162fd73", "level": "note", "message": {"text": "Very large file: codex-rs/core/tests/suite/compact_remote.rs (4371 lines)"}, "properties": {"repobilityId": "1017d2a39b28b99e", "scanner": "scanner-primary", "fingerprint": "df6caddf9162fd73", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-42f7cdf72ac78ebf", "level": "note", "message": {"text": "Very large file: codex-rs/core/tests/suite/view_image.rs (1542 lines)"}, "properties": {"repobilityId": "114383c08f8473fc", "scanner": "scanner-primary", "fingerprint": "42f7cdf72ac78ebf", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ac7910c4f4acb65", "level": "note", "message": {"text": "Very large file: codex-rs/core/tests/suite/request_permissions.rs (1942 lines)"}, "properties": {"repobilityId": "e253af3fcd08eb6e", "scanner": "scanner-primary", "fingerprint": "3ac7910c4f4acb65", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-116006ae54fb8e3a", "level": "note", "message": {"text": "Very large file: codex-rs/core/tests/suite/client.rs (3852 lines)"}, "properties": {"repobilityId": "8f87da681a2493ad", "scanner": "scanner-primary", "fingerprint": "116006ae54fb8e3a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-49bac79a86c666ee", "level": "note", "message": {"text": "Very large file: codex-rs/core/tests/suite/hooks.rs (4249 lines)"}, "properties": {"repobilityId": "0ea6a899867be1dc", "scanner": "scanner-primary", "fingerprint": "49bac79a86c666ee", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a94cb123338291b4", "level": "note", "message": {"text": "Very large file: codex-rs/core/tests/suite/compact.rs (5293 lines)"}, "properties": {"repobilityId": "cbf8989892e57df1", "scanner": "scanner-primary", "fingerprint": "a94cb123338291b4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ab60af74a7fb1ec4", "level": "note", "message": {"text": "Very large file: codex-rs/core/src/thread_manager.rs (1921 lines)"}, "properties": {"repobilityId": "d9167d78a9465240", "scanner": "scanner-primary", "fingerprint": "ab60af74a7fb1ec4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9db101f70c279e6e", "level": "note", "message": {"text": "Very large file: codex-rs/core/src/mcp_tool_call_tests.rs (3118 lines)"}, "properties": {"repobilityId": "6a630f871da4054d", "scanner": "scanner-primary", "fingerprint": "9db101f70c279e6e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-98b23cc0f5158a1d", "level": "note", "message": {"text": "Very large file: codex-rs/core/src/thread_manager_tests.rs (1885 lines)"}, "properties": {"repobilityId": "bcf7e8720de11edc", "scanner": "scanner-primary", "fingerprint": "98b23cc0f5158a1d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-fdcc6dd41c78050b", "level": "note", "message": {"text": "Very large file: codex-rs/core/src/realtime_conversation.rs (1846 lines)"}, "properties": {"repobilityId": "bc64f43db26cea41", "scanner": "scanner-primary", "fingerprint": "fdcc6dd41c78050b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-306bae210d2e196b", "level": "note", "message": {"text": "Very large file: codex-rs/core/src/mcp_tool_call.rs (2231 lines)"}, "properties": {"repobilityId": "934c2af9e0270c65", "scanner": "scanner-primary", "fingerprint": "306bae210d2e196b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-add9b0706d51e2b7", "level": "note", "message": {"text": "Very large file: codex-rs/core/src/exec_policy_tests.rs (2428 lines)"}, "properties": {"repobilityId": "9fc3101b398f3503", "scanner": "scanner-primary", "fingerprint": "add9b0706d51e2b7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-8066ffa88006eebf", "level": "note", "message": {"text": "Very large file: codex-rs/core/src/client.rs (3609 lines)"}, "properties": {"repobilityId": "aa5fabba05ff3f9b", "scanner": "scanner-primary", "fingerprint": "8066ffa88006eebf", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-00d20f348eac372b", "level": "note", "message": {"text": "Very large file: codex-rs/core/src/config/config_tests.rs (11421 lines)"}, "properties": {"repobilityId": "09d0a768e8a6dd5b", "scanner": "scanner-primary", "fingerprint": "00d20f348eac372b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b012d588ea1f524a", "level": "note", "message": {"text": "Very large file: codex-rs/core/src/config/mod.rs (4383 lines)"}, "properties": {"repobilityId": "6290974af5c3b0c7", "scanner": "scanner-primary", "fingerprint": "b012d588ea1f524a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4f4d48e1edb27b36", "level": "note", "message": {"text": "Very large file: codex-rs/core/src/config/config_loader_tests.rs (3828 lines)"}, "properties": {"repobilityId": "ad9957880a71d8db", "scanner": "scanner-primary", "fingerprint": "4f4d48e1edb27b36", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b34e2c140998016c", "level": "note", "message": {"text": "Very large file: codex-rs/core/src/agent/control_tests.rs (3466 lines)"}, "properties": {"repobilityId": "8efcb7acfcc83093", "scanner": "scanner-primary", "fingerprint": "b34e2c140998016c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ae64e6f1c06d1408", "level": "note", "message": {"text": "Very large file: codex-rs/core/src/guardian/review_session.rs (1913 lines)"}, "properties": {"repobilityId": "2ed0a23f0fc510a1", "scanner": "scanner-primary", "fingerprint": "ae64e6f1c06d1408", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-02413d10fc4d95bf", "level": "note", "message": {"text": "Very large file: codex-rs/core/src/guardian/tests.rs (3207 lines)"}, "properties": {"repobilityId": "d76f36fc3e189f84", "scanner": "scanner-primary", "fingerprint": "02413d10fc4d95bf", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-36f752dc90ef94de", "level": "note", "message": {"text": "Very large file: codex-rs/core/src/tools/spec_plan_tests.rs (1662 lines)"}, "properties": {"repobilityId": "d683c9c408c84b6d", "scanner": "scanner-primary", "fingerprint": "36f752dc90ef94de", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e3f18e79d6328cd0", "level": "note", "message": {"text": "Very large file: codex-rs/core/src/tools/handlers/harness_aliases.rs (5212 lines)"}, "properties": {"repobilityId": "fea9b5d7ce4cd911", "scanner": "scanner-primary", "fingerprint": "e3f18e79d6328cd0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-57c6a50cd8e5cc9e", "level": "note", "message": {"text": "Very large file: codex-rs/core/src/tools/handlers/multi_agents_tests.rs (4573 lines)"}, "properties": {"repobilityId": "05e8f4584ae5a465", "scanner": "scanner-primary", "fingerprint": "57c6a50cd8e5cc9e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ee19eadbf7bc786", "level": "note", "message": {"text": "Very large file: codex-rs/core/src/context_manager/history_tests.rs (2259 lines)"}, "properties": {"repobilityId": "477d1ea731197a0f", "scanner": "scanner-primary", "fingerprint": "3ee19eadbf7bc786", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-766b0c1dbbb4951e", "level": "note", "message": {"text": "Very large file: codex-rs/core/src/session/rollout_reconstruction_tests.rs (1902 lines)"}, "properties": {"repobilityId": "eba1efe1a4cf1bac", "scanner": "scanner-primary", "fingerprint": "766b0c1dbbb4951e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-bd6f94539bee8dcf", "level": "note", "message": {"text": "Very large file: codex-rs/core/src/session/mod.rs (4086 lines)"}, "properties": {"repobilityId": "a3693b63a6b5e4e6", "scanner": "scanner-primary", "fingerprint": "bd6f94539bee8dcf", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-072e9da6666a6857", "level": "note", "message": {"text": "Very large file: codex-rs/core/src/session/turn.rs (2603 lines)"}, "properties": {"repobilityId": "d0475e93e050295c", "scanner": "scanner-primary", "fingerprint": "072e9da6666a6857", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-96f2b57b99c3a584", "level": "note", "message": {"text": "Very large file: codex-rs/core/src/session/session.rs (1312 lines)"}, "properties": {"repobilityId": "6335e44d10be5f19", "scanner": "scanner-primary", "fingerprint": "96f2b57b99c3a584", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-79fa9ec2dccad0d9", "level": "note", "message": {"text": "Very large file: codex-rs/core/src/session/tests.rs (11081 lines)"}, "properties": {"repobilityId": "b55ec47794ea38d3", "scanner": "scanner-primary", "fingerprint": "79fa9ec2dccad0d9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-096fb96200c7a90d", "level": "note", "message": {"text": "Very large file: codex-rs/core/src/harness/opencode.rs (864 lines)"}, "properties": {"repobilityId": "6f2defecd6b2ae7f", "scanner": "scanner-primary", "fingerprint": "096fb96200c7a90d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-da4b884f8ed3d75c", "level": "note", "message": {"text": "Very large file: codex-rs/core/src/harness/terminus_2.rs (2138 lines)"}, "properties": {"repobilityId": "e641ccded1de5d2c", "scanner": "scanner-primary", "fingerprint": "da4b884f8ed3d75c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-446b54d4a08a57d2", "level": "note", "message": {"text": "Very large file: codex-rs/core/src/harness/zcode.rs (2654 lines)"}, "properties": {"repobilityId": "8bd3fab96f7e4d28", "scanner": "scanner-primary", "fingerprint": "446b54d4a08a57d2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d7a9181c84506770", "level": "note", "message": {"text": "Very large file: codex-rs/core/src/harness/claude_code.rs (4702 lines)"}, "properties": {"repobilityId": "62d4bc35dfe8ce2e", "scanner": "scanner-primary", "fingerprint": "d7a9181c84506770", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-35900dd40b4ae016", "level": "note", "message": {"text": "Very large file: codex-rs/core/src/harness/kimi_cli.rs (2820 lines)"}, "properties": {"repobilityId": "b5c4e15e2e27cd1a", "scanner": "scanner-primary", "fingerprint": "35900dd40b4ae016", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a3fc7159d7ec1c59", "level": "note", "message": {"text": "Very large file: codex-rs/core/src/unified_exec/process_manager.rs (1462 lines)"}, "properties": {"repobilityId": "5a299299e0368677", "scanner": "scanner-primary", "fingerprint": "a3fc7159d7ec1c59", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3637195500f63a59", "level": "note", "message": {"text": "Very large file: codex-rs/app-server-protocol/src/export.rs (3014 lines)"}, "properties": {"repobilityId": "cf53c7d2e0055781", "scanner": "scanner-primary", "fingerprint": "3637195500f63a59", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0a7288897b18a805", "level": "note", "message": {"text": "Very large file: codex-rs/app-server-protocol/src/protocol/thread_history.rs (4384 lines)"}, "properties": {"repobilityId": "c23509d318d469b5", "scanner": "scanner-primary", "fingerprint": "0a7288897b18a805", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-8b203b6d510ec8d5", "level": "note", "message": {"text": "Very large file: codex-rs/app-server-protocol/src/protocol/common.rs (3801 lines)"}, "properties": {"repobilityId": "ab87d1d3e94b703c", "scanner": "scanner-primary", "fingerprint": "8b203b6d510ec8d5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d393b7266e03cb90", "level": "note", "message": {"text": "Very large file: codex-rs/app-server-protocol/src/protocol/v2/item.rs (1646 lines)"}, "properties": {"repobilityId": "0b00d4dd1343f343", "scanner": "scanner-primary", "fingerprint": "d393b7266e03cb90", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3281d7cb067c2c0e", "level": "note", "message": {"text": "Very large file: codex-rs/app-server-protocol/src/protocol/v2/thread.rs (1506 lines)"}, "properties": {"repobilityId": "d2c116f3714c7c6a", "scanner": "scanner-primary", "fingerprint": "3281d7cb067c2c0e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e61abb6f3347e95c", "level": "note", "message": {"text": "Very large file: codex-rs/app-server-protocol/src/protocol/v2/tests.rs (4333 lines)"}, "properties": {"repobilityId": "8ed5d8bd9e5a8522", "scanner": "scanner-primary", "fingerprint": "e61abb6f3347e95c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0c2c781c4e0de291", "level": "note", "message": {"text": "Very large file: codex-rs/protocol/src/protocol.rs (6205 lines)"}, "properties": {"repobilityId": "5521c94420a96582", "scanner": "scanner-primary", "fingerprint": "0c2c781c4e0de291", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f4ebe21cd2179639", "level": "note", "message": {"text": "Very large file: codex-rs/protocol/src/models.rs (3669 lines)"}, "properties": {"repobilityId": "b8e30adcada430e1", "scanner": "scanner-primary", "fingerprint": "f4ebe21cd2179639", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a6ddf04de5a953f0", "level": "note", "message": {"text": "Very large file: codex-rs/protocol/src/permissions.rs (3269 lines)"}, "properties": {"repobilityId": "6d457391c2a090a1", "scanner": "scanner-primary", "fingerprint": "a6ddf04de5a953f0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e84e8d0d6094e6b0", "level": "note", "message": {"text": "Very large file: codex-rs/codex-api/src/endpoint/realtime_websocket/methods.rs (2490 lines)"}, "properties": {"repobilityId": "589b61d40ffd6e23", "scanner": "scanner-primary", "fingerprint": "e84e8d0d6094e6b0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-bbb456ec00102944", "level": "note", "message": {"text": "Very large file: codex-rs/codex-api/src/sse/responses.rs (1633 lines)"}, "properties": {"repobilityId": "fe5981efc5b507ef", "scanner": "scanner-primary", "fingerprint": "bbb456ec00102944", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e9d57a543c116c9c", "level": "note", "message": {"text": "Very large file: codex-rs/rollout/src/list.rs (1544 lines)"}, "properties": {"repobilityId": "cd6cb27d37a536e7", "scanner": "scanner-primary", "fingerprint": "e9d57a543c116c9c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c1a9c9be60d13fd7", "level": "note", "message": {"text": "Very large file: codex-rs/rollout/src/recorder.rs (1975 lines)"}, "properties": {"repobilityId": "2724fb8eae194c5d", "scanner": "scanner-primary", "fingerprint": "c1a9c9be60d13fd7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-44e8e5f70512f47f", "level": "note", "message": {"text": "Very large file: codex-rs/rollout/src/tests.rs (1720 lines)"}, "properties": {"repobilityId": "2e14087c4d2f3230", "scanner": "scanner-primary", "fingerprint": "44e8e5f70512f47f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6cae4cbfeffe6ab6", "level": "note", "message": {"text": "Very large file: codex-rs/external-agent-migration/src/lib.rs (2211 lines)"}, "properties": {"repobilityId": "40e8270734bb3cd9", "scanner": "scanner-primary", "fingerprint": "6cae4cbfeffe6ab6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-da27ee54b2064408", "level": "note", "message": {"text": "Very large file: codex-rs/apply-patch/src/lib.rs (1719 lines)"}, "properties": {"repobilityId": "9f76af867d03dab5", "scanner": "scanner-primary", "fingerprint": "da27ee54b2064408", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7b25b71a1b563894", "level": "note", "message": {"text": "Very large file: codex-rs/app-server-test-client/src/lib.rs (2354 lines)"}, "properties": {"repobilityId": "ae101736eeffb4aa", "scanner": "scanner-primary", "fingerprint": "7b25b71a1b563894", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-edaeeefa062ff957", "level": "note", "message": {"text": "Very large file: codex-rs/network-proxy/src/http_proxy.rs (1631 lines)"}, "properties": {"repobilityId": "4747e8550116111d", "scanner": "scanner-primary", "fingerprint": "edaeeefa062ff957", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e3a57bf045782fa0", "level": "note", "message": {"text": "Very large file: codex-rs/network-proxy/src/proxy.rs (1617 lines)"}, "properties": {"repobilityId": "9dd3b4529c098add", "scanner": "scanner-primary", "fingerprint": "e3a57bf045782fa0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7e0e7973edfcd67b", "level": "note", "message": {"text": "Very large file: codex-rs/network-proxy/src/runtime.rs (2135 lines)"}, "properties": {"repobilityId": "221ffd34335bf52a", "scanner": "scanner-primary", "fingerprint": "7e0e7973edfcd67b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2e27019f5191c3d1", "level": "note", "message": {"text": "Very large file: codex-rs/core-plugins/src/marketplace_tests.rs (2239 lines)"}, "properties": {"repobilityId": "bea3363bd705676d", "scanner": "scanner-primary", "fingerprint": "2e27019f5191c3d1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-66474b37a2b178f6", "level": "note", "message": {"text": "Very large file: codex-rs/core-plugins/src/manager.rs (2761 lines)"}, "properties": {"repobilityId": "07080aa99d3e3cef", "scanner": "scanner-primary", "fingerprint": "66474b37a2b178f6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f491352da15f7122", "level": "note", "message": {"text": "Very large file: codex-rs/core-plugins/src/loader.rs (1521 lines)"}, "properties": {"repobilityId": "c0c04deb257f4a6a", "scanner": "scanner-primary", "fingerprint": "f491352da15f7122", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e852b50bc56ebdde", "level": "note", "message": {"text": "Very large file: codex-rs/core-plugins/src/manager_tests.rs (5876 lines)"}, "properties": {"repobilityId": "6cc9e3846ad4e10e", "scanner": "scanner-primary", "fingerprint": "e852b50bc56ebdde", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-baf6bf437d427c28", "level": "note", "message": {"text": "Very large file: codex-rs/core-plugins/src/remote.rs (1963 lines)"}, "properties": {"repobilityId": "09878c10fd90f744", "scanner": "scanner-primary", "fingerprint": "baf6bf437d427c28", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6b8a69741998e816", "level": "note", "message": {"text": "Very large file: codex-rs/app-server-transport/src/transport/remote_control/websocket.rs (3522 lines)"}, "properties": {"repobilityId": "02f27614c1a09a59", "scanner": "scanner-primary", "fingerprint": "6b8a69741998e816", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a2be8164e24475af", "level": "note", "message": {"text": "Very large file: codex-rs/app-server-transport/src/transport/remote_control/tests.rs (2853 lines)"}, "properties": {"repobilityId": "3d664b5db65e29c0", "scanner": "scanner-primary", "fingerprint": "a2be8164e24475af", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2d5ba0513cb82bb6", "level": "note", "message": {"text": "Very large file: sdk/python/scripts/update_sdk_artifacts.py (1376 lines)"}, "properties": {"repobilityId": "93fecc0e455277e7", "scanner": "scanner-primary", "fingerprint": "2d5ba0513cb82bb6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-76a330f67230c4fa", "level": "note", "message": {"text": "Very large file: sdk/python/src/openai_codex/generated/v2_all.py (8619 lines)"}, "properties": {"repobilityId": "a4d427a7bedfebde", "scanner": "scanner-primary", "fingerprint": "76a330f67230c4fa", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-8e9c1f12e755b9d8", "level": "note", "message": {"text": "136 TODO/FIXME markers"}, "properties": {"repobilityId": "4b38c118003e07d2", "scanner": "scanner-primary", "fingerprint": "8e9c1f12e755b9d8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["maintenance"]}}, {"ruleId": "scanner-94c600503366fc46", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: sdk/typescript/package.json"}, "properties": {"repobilityId": "5150dcc1260d3576", "scanner": "scanner-primary", "fingerprint": "94c600503366fc46", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sdk/typescript/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "7ad1f7ce7f01ed78", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "1efe6a15849fbd07", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-9d79c4077342a7d0", "level": "warning", "message": {"text": "Runtime service client appears to use placeholder configuration"}, "properties": {"repobilityId": "5ec5a91e0f9b5b70", "scanner": "scanner-primary", "fingerprint": "9d79c4077342a7d0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "runtime-config", "service-client", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "137020dbafc7a54b", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "ac2731f1ed8d7023", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-69bdca36b063bcb4", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 codex-rs/windows-sandbox-rs/sandbox_smoketests.py:130"}, "properties": {"repobilityId": "093cb4337b5a5273", "scanner": "scanner-primary", "fingerprint": "69bdca36b063bcb4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-29a90d3e68be3dba", "level": "note", "message": {"text": "Stub function `log_message` (body is just `pass`/`return`) \u2014 codex-rs/windows-sandbox-rs/sandbox_smoketests.py:146"}, "properties": {"repobilityId": "9f4074b5d880c860", "scanner": "scanner-primary", "fingerprint": "29a90d3e68be3dba", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-242c4c638084858d", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 codex-rs/skills/src/assets/samples/skill-installer/scripts/github_utils.py:16"}, "properties": {"repobilityId": "414bef8c05cce14d", "scanner": "scanner-primary", "fingerprint": "242c4c638084858d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-d38a630d9cb1dd89", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 codex-rs/skills/src/assets/samples/skill-installer/scripts/install-skill-from-github.py:100"}, "properties": {"repobilityId": "b8a9c6f728b2ec36", "scanner": "scanner-primary", "fingerprint": "d38a630d9cb1dd89", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-6ef50357721eb4ca", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 codex-rs/skills/src/assets/samples/openai-docs/scripts/fetch-codex-manual.mjs:175"}, "properties": {"repobilityId": "f41672c7ecf661e7", "scanner": "scanner-primary", "fingerprint": "6ef50357721eb4ca", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b49c3cf69a969d22", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 codex-rs/skills/src/assets/samples/openai-docs/scripts/resolve-latest-model-info.js:39"}, "properties": {"repobilityId": "06582dc16134846e", "scanner": "scanner-primary", "fingerprint": "b49c3cf69a969d22", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2b3fc9d1a09c91d4", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/check_blob_size.py:25"}, "properties": {"repobilityId": "51342caee682883c", "scanner": "scanner-primary", "fingerprint": "2b3fc9d1a09c91d4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9863990bb56aa86c", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/format.py:52"}, "properties": {"repobilityId": "bfcbdcfd62dedcbd", "scanner": "scanner-primary", "fingerprint": "9863990bb56aa86c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1452394444602e77", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/stage_npm_packages.py:150"}, "properties": {"repobilityId": "f325338b8b691ae6", "scanner": "scanner-primary", "fingerprint": "1452394444602e77", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9f5dd2c14e81d590", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/just-shell.py:57"}, "properties": {"repobilityId": "c83574eb2b7720f2", "scanner": "scanner-primary", "fingerprint": "9f5dd2c14e81d590", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3c2ae80f739f5045", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/codex_package/cargo.py:81"}, "properties": {"repobilityId": "62a98a8b17c6efda", "scanner": "scanner-primary", "fingerprint": "3c2ae80f739f5045", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-cceb500ec89aec57", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 codex-cli/scripts/build_npm_package.py:329"}, "properties": {"repobilityId": "85c9c0cf4041fa3c", "scanner": "scanner-primary", "fingerprint": "cceb500ec89aec57", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e4a8c9a1c8984a3d", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 .github/scripts/v8_canary_changes.py:117"}, "properties": {"repobilityId": "7879cf165ac5d82d", "scanner": "scanner-primary", "fingerprint": "e4a8c9a1c8984a3d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b86b0f4fa0c4d395", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 .github/scripts/rusty_v8_bazel.py:33"}, "properties": {"repobilityId": "f68fbc45c52f838c", "scanner": "scanner-primary", "fingerprint": "b86b0f4fa0c4d395", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-19f056b6d6f3b9e8", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 .github/scripts/run_bazel_with_buildbuddy.py:210"}, "properties": {"repobilityId": "8b396997a76dda60", "scanner": "scanner-primary", "fingerprint": "19f056b6d6f3b9e8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-74c72de59e7442bd", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 sdk/python/_runtime_setup.py:126"}, "properties": {"repobilityId": "503a614524257756", "scanner": "scanner-primary", "fingerprint": "74c72de59e7442bd", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-fef73b35db66eb72", "level": "note", "message": {"text": "Legacy-named symbol `pydantic_v2` in sdk/python/scripts/update_sdk_artifacts.py:595"}, "properties": {"repobilityId": "1fe13cacb4a8ac14", "scanner": "scanner-primary", "fingerprint": "fef73b35db66eb72", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-e0f04258ee5d3fa8", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 sdk/python/scripts/update_sdk_artifacts.py:65"}, "properties": {"repobilityId": "408424460464f6b5", "scanner": "scanner-primary", "fingerprint": "e0f04258ee5d3fa8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-111255916c602937", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in sdk/python/src/openai_codex/_goal.py:214"}, "properties": {"repobilityId": "918d404453a8de2b", "scanner": "scanner-primary", "fingerprint": "111255916c602937", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-251745b7cb25292b", "level": "note", "message": {"text": "Legacy-named symbol `upgrade_copy` in sdk/python/src/openai_codex/generated/v2_all.py:2118"}, "properties": {"repobilityId": "6da96f2a63b31229", "scanner": "scanner-primary", "fingerprint": "251745b7cb25292b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "0483829e23a04bbb", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "4e8de0d711a27295", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-ffd670c4e7be5fb3", "level": "warning", "message": {"text": "Vulnerable dependency anyhow 1.0.102: RUSTSEC-2026-0190"}, "properties": {"repobilityId": "b0f8e201981c9769", "scanner": "scanner-primary", "fingerprint": "ffd670c4e7be5fb3", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "RUSTSEC-2026-0190"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a85881aba6042985", "level": "error", "message": {"text": "Vulnerable dependency gix 0.81.0: GHSA-f26g-jm89-4g65"}, "properties": {"repobilityId": "ecabfc9826afed15", "scanner": "scanner-primary", "fingerprint": "a85881aba6042985", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-f26g-jm89-4g65"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2a0c44e9a724f4cd", "level": "error", "message": {"text": "Vulnerable dependency gix 0.81.0: GHSA-fr8x-3vfx-f45h"}, "properties": {"repobilityId": "2d3307268e1adc0f", "scanner": "scanner-primary", "fingerprint": "2a0c44e9a724f4cd", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-fr8x-3vfx-f45h"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-46af6b041fa39279", "level": "error", "message": {"text": "Vulnerable dependency gix 0.81.0: GHSA-p3hw-mv63-rf9w"}, "properties": {"repobilityId": "c1aeb4cd27500868", "scanner": "scanner-primary", "fingerprint": "46af6b041fa39279", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-p3hw-mv63-rf9w"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7981fe9a5fea62e2", "level": "error", "message": {"text": "Vulnerable dependency gix 0.81.0: GHSA-pg4w-g64p-qwhj"}, "properties": {"repobilityId": "f6885577304b5701", "scanner": "scanner-primary", "fingerprint": "7981fe9a5fea62e2", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-pg4w-g64p-qwhj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f0e41eebfdfd706c", "level": "warning", "message": {"text": "Vulnerable dependency jsonwebtoken 9.3.1: GHSA-h395-gr6q-cpjc"}, "properties": {"repobilityId": "44eccd22464cd00f", "scanner": "scanner-primary", "fingerprint": "f0e41eebfdfd706c", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-h395-gr6q-cpjc"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f91e5b1408347ad4", "level": "warning", "message": {"text": "Vulnerable dependency lru 0.12.5: GHSA-rhfx-m35p-ff5j"}, "properties": {"repobilityId": "0510b44ff3d6180e", "scanner": "scanner-primary", "fingerprint": "f91e5b1408347ad4", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-rhfx-m35p-ff5j"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1d9127eb8271bb87", "level": "warning", "message": {"text": "Vulnerable dependency opentelemetry_sdk 0.31.0: GHSA-w9wp-h8wv-79jx"}, "properties": {"repobilityId": "4dba62fc432f03d5", "scanner": "scanner-primary", "fingerprint": "1d9127eb8271bb87", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-w9wp-h8wv-79jx"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d2f52510596b5848", "level": "warning", "message": {"text": "Vulnerable dependency quick-xml 0.39.4: RUSTSEC-2026-0194"}, "properties": {"repobilityId": "5755587ce549aec3", "scanner": "scanner-primary", "fingerprint": "d2f52510596b5848", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "RUSTSEC-2026-0194"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b330f3118570d843", "level": "warning", "message": {"text": "Vulnerable dependency quick-xml 0.39.4: RUSTSEC-2026-0195"}, "properties": {"repobilityId": "9680ce51ca40d20b", "scanner": "scanner-primary", "fingerprint": "b330f3118570d843", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "RUSTSEC-2026-0195"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-150b355e79ae9965", "level": "warning", "message": {"text": "Vulnerable dependency tar 0.4.45: GHSA-3pv8-6f4r-ffg2"}, "properties": {"repobilityId": "7f508ff5725663f2", "scanner": "scanner-primary", "fingerprint": "150b355e79ae9965", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3pv8-6f4r-ffg2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7089087a558930a5", "level": "warning", "message": {"text": "Vulnerable dependency tar 0.4.44: GHSA-3pv8-6f4r-ffg2"}, "properties": {"repobilityId": "e7adc9fade001aa5", "scanner": "scanner-primary", "fingerprint": "7089087a558930a5", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3pv8-6f4r-ffg2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/argument-comment-lint/Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6c13a20cb6a7e70f", "level": "error", "message": {"text": "Vulnerable dependency tar 0.4.44: GHSA-gchp-q4r4-x4ff"}, "properties": {"repobilityId": "fe1640f586a8ee28", "scanner": "scanner-primary", "fingerprint": "6c13a20cb6a7e70f", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-gchp-q4r4-x4ff"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/argument-comment-lint/Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b31e0b6948b78b65", "level": "warning", "message": {"text": "Vulnerable dependency tar 0.4.44: GHSA-j4xf-2g29-59ph"}, "properties": {"repobilityId": "da1e6c4286a68d4f", "scanner": "scanner-primary", "fingerprint": "b31e0b6948b78b65", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-j4xf-2g29-59ph"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/argument-comment-lint/Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b46b44ec265fc0f4", "level": "warning", "message": {"text": "Vulnerable dependency actix-http 3.11.2: GHSA-xhj4-vrgc-hr34"}, "properties": {"repobilityId": "a911c6242d8844cd", "scanner": "scanner-primary", "fingerprint": "b46b44ec265fc0f4", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-xhj4-vrgc-hr34", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f30114950388ab6b", "level": "warning", "message": {"text": "Vulnerable dependency atomic-polyfill 1.0.3: RUSTSEC-2023-0089"}, "properties": {"repobilityId": "bcf8e56c221891d2", "scanner": "scanner-primary", "fingerprint": "f30114950388ab6b", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2023-0089", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-906635012de5d66d", "level": "warning", "message": {"text": "Vulnerable dependency bincode 1.3.3: RUSTSEC-2025-0141"}, "properties": {"repobilityId": "868d7151a94663d2", "scanner": "scanner-primary", "fingerprint": "906635012de5d66d", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2025-0141", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-464d8c6972dac162", "level": "warning", "message": {"text": "Vulnerable dependency cmov 0.5.3: GHSA-3rjw-m598-pq24"}, "properties": {"repobilityId": "77c443cdf893e449", "scanner": "scanner-primary", "fingerprint": "464d8c6972dac162", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3rjw-m598-pq24", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b609d0440e456c53", "level": "warning", "message": {"text": "Vulnerable dependency cxx 1.0.194: RUSTSEC-2026-0202"}, "properties": {"repobilityId": "d97a80e7ccf64233", "scanner": "scanner-primary", "fingerprint": "b609d0440e456c53", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2026-0202", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-36b5d007100b3453", "level": "warning", "message": {"text": "Vulnerable dependency derivative 2.2.0: RUSTSEC-2024-0388"}, "properties": {"repobilityId": "f590292230b76bbb", "scanner": "scanner-primary", "fingerprint": "36b5d007100b3453", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2024-0388", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-06efaaa98b4036d1", "level": "note", "message": {"text": "Dependency agent-client-protocol is a major version behind"}, "properties": {"repobilityId": "77ad4e6c028bcd5c", "scanner": "scanner-primary", "fingerprint": "06efaaa98b4036d1", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/acp-server/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-84717f7c2f6f8895", "level": "note", "message": {"text": "Dependency ansi-to-tui is a major version behind"}, "properties": {"repobilityId": "1f40f5a8068aa402", "scanner": "scanner-primary", "fingerprint": "84717f7c2f6f8895", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/ansi-escape/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b671cefe77e5804c", "level": "note", "message": {"text": "Dependency chardetng is a major version behind"}, "properties": {"repobilityId": "98db0a8c6eb1f309", "scanner": "scanner-primary", "fingerprint": "b671cefe77e5804c", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/protocol/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c91037490406c768", "level": "note", "message": {"text": "Dependency ctor is a major version behind"}, "properties": {"repobilityId": "377cde06e7e0bcc0", "scanner": "scanner-primary", "fingerprint": "c91037490406c768", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "codex-rs/core/tests/common/Cargo.toml"}, "region": {"startLine": 1}}}]}]}]}