{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-1c2ccc26fcc15a5b", "name": "Possibly dead Python function: positive_int", "shortDescription": {"text": "Possibly dead Python function: positive_int"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-efef18d1a9425077", "name": "Possibly dead Python function: fake_df", "shortDescription": {"text": "Possibly dead Python function: fake_df"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9de7f94f5388bd90", "name": "Possibly dead Python function: fake_lspci", "shortDescription": {"text": "Possibly dead Python function: fake_lspci"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4dfd73a0930d507f", "name": "Stray `console.log` in TS/JS \u2014 remote/src/server/index.ts:73", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 remote/src/server/index.ts:73"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0de35eb12ec5b4d8", "name": "Docker base image is tag-pinned but not digest-pinned: node:22-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8730c6139cf4edd7", "name": "Insecure pattern 'direct_innerhtml_assignment' in docs/themes.html:163", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in docs/themes.html:163"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-98be976ee51169da", "name": "Possible secret in docs/ai.zh.html", "shortDescription": {"text": "Possible secret in docs/ai.zh.html"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-759a594032dd179b", "name": "Possible secret in docs/ai.html", "shortDescription": {"text": "Possible secret in docs/ai.html"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-2428bac36aea129e", "name": "Insecure pattern 'direct_innerhtml_assignment' in remote/src/client/theme.ts:74", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in remote/src/client/theme.ts:74"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2b2e97430727ad6d", "name": "Insecure pattern 'direct_innerhtml_assignment' in remote/src/client/views/login.ts:8", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in remote/src/client/views/login.ts:8"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5d2b6e1ae7cfb6ef", "name": "Insecure pattern 'direct_innerhtml_assignment' in remote/src/client/views/console.ts:71", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in remote/src/client/views/console.ts:71"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b628e7ae5b060c98", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "mlugg/setup-zig@v2 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b3aea0a85250129e", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cec841feb47f58c9", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-41fdb0d1c285948d", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ed258c862e78e88e", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "mlugg/setup-zig@v2 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-38b8ccbb498b5246", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e4f658c0c00de0d4", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-448d8837178ae57a", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d6a9a38ac60e4681", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c6e2985d5455cffb", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e1cd0399b583c635", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1559d882daf1bd74", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-391adb6592443f79", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dee297f21d82e978", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-92446d7cbb9ca7de", "name": "Very large file: docs/themes-data.js (11781 lines)", "shortDescription": {"text": "Very large file: docs/themes-data.js (11781 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 11 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0a2d487057f9e738", "name": "Agent authority lacks a verifier contract: plugins/skills/inspect-computer-config/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: plugins/skills/inspect-computer-config/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fe825f204c5b4152", "name": "`fetch()` without try/.catch or AbortSignal \u2014 remote/src/worker.ts:34", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 remote/src/worker.ts:34"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1bd0cd4a13693659", "name": "Network/subprocess call without timeout or try/except \u2014 tools/kitty_graphics.py:87", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/kitty_graphics.py:87"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b334d875f2339fa1", "name": "5 env vars used in code but missing from .env.example", "shortDescription": {"text": "5 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `DIST_DIR`, `HOST`, `PORT`, `REMOTE_COOKIE_SECURE`, `REMOTE_DATA_DIR`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23082"}, "properties": {"repository": "xuzhougeng/wispterm", "repoUrl": "https://github.com/xuzhougeng/wispterm", "branch": "main"}, "results": [{"ruleId": "scanner-1c2ccc26fcc15a5b", "level": "note", "message": {"text": "Possibly dead Python function: positive_int"}, "properties": {"repobilityId": "4bd4f862ce15138a", "scanner": "scanner-primary", "fingerprint": "1c2ccc26fcc15a5b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/kitty_graphics.py:162"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-efef18d1a9425077", "level": "note", "message": {"text": "Possibly dead Python function: fake_df"}, "properties": {"repobilityId": "4f0bd4ff17ed4d26", "scanner": "scanner-primary", "fingerprint": "efef18d1a9425077", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/skills/inspect-computer-config/scripts/inspect_computer_config.py:395"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9de7f94f5388bd90", "level": "note", "message": {"text": "Possibly dead Python function: fake_lspci"}, "properties": {"repobilityId": "7de0a5a39c5cdfbe", "scanner": "scanner-primary", "fingerprint": "9de7f94f5388bd90", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/skills/inspect-computer-config/scripts/inspect_computer_config.py:412"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4dfd73a0930d507f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 remote/src/server/index.ts:73"}, "properties": {"repobilityId": "0a3f86d90c2d1c2a", "scanner": "scanner-primary", "fingerprint": "4dfd73a0930d507f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-0de35eb12ec5b4d8", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-alpine"}, "properties": {"repobilityId": "2cf643b56c1fa3fd", "scanner": "scanner-primary", "fingerprint": "0de35eb12ec5b4d8", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "remote/Dockerfile"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-0de35eb12ec5b4d8", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-alpine"}, "properties": {"repobilityId": "5767866bb3bed621", "scanner": "scanner-primary", "fingerprint": "0de35eb12ec5b4d8", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "remote/Dockerfile"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-8730c6139cf4edd7", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in docs/themes.html:163"}, "properties": {"repobilityId": "a0d20740a07e8c45", "scanner": "scanner-primary", "fingerprint": "8730c6139cf4edd7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/themes.html"}, "region": {"startLine": 163}}}]}, {"ruleId": "scanner-98be976ee51169da", "level": "error", "message": {"text": "Possible secret in docs/ai.zh.html"}, "properties": {"repobilityId": "beaa4c7925f35441", "scanner": "scanner-primary", "fingerprint": "98be976ee51169da", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/ai.zh.html"}, "region": {"startLine": 136}}}]}, {"ruleId": "scanner-98be976ee51169da", "level": "error", "message": {"text": "Possible secret in docs/ai.zh.html"}, "properties": {"repobilityId": "beaa4c7925f35441", "scanner": "scanner-primary", "fingerprint": "98be976ee51169da", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/ai.zh.html"}, "region": {"startLine": 141}}}]}, {"ruleId": "scanner-759a594032dd179b", "level": "error", "message": {"text": "Possible secret in docs/ai.html"}, "properties": {"repobilityId": "8831853755315faf", "scanner": "scanner-primary", "fingerprint": "759a594032dd179b", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/ai.html"}, "region": {"startLine": 136}}}]}, {"ruleId": "scanner-759a594032dd179b", "level": "error", "message": {"text": "Possible secret in docs/ai.html"}, "properties": {"repobilityId": "8831853755315faf", "scanner": "scanner-primary", "fingerprint": "759a594032dd179b", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/ai.html"}, "region": {"startLine": 141}}}]}, {"ruleId": "scanner-2428bac36aea129e", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in remote/src/client/theme.ts:74"}, "properties": {"repobilityId": "5e852bfb99c1471d", "scanner": "scanner-primary", "fingerprint": "2428bac36aea129e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "remote/src/client/theme.ts"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-2b2e97430727ad6d", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in remote/src/client/views/login.ts:8"}, "properties": {"repobilityId": "fdb5513317d08020", "scanner": "scanner-primary", "fingerprint": "2b2e97430727ad6d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "remote/src/client/views/login.ts"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-5d2b6e1ae7cfb6ef", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in remote/src/client/views/console.ts:71"}, "properties": {"repobilityId": "27e5063781b32cc0", "scanner": "scanner-primary", "fingerprint": "5d2b6e1ae7cfb6ef", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "remote/src/client/views/console.ts"}, "region": {"startLine": 71}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-b628e7ae5b060c98", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "81e7852a8a307794", "scanner": "scanner-primary", "fingerprint": "b628e7ae5b060c98", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/wisptermctl-release.yml"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-b628e7ae5b060c98", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2c278fb5138feaa8", "scanner": "scanner-primary", "fingerprint": "b628e7ae5b060c98", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/wisptermctl-release.yml"}, "region": {"startLine": 102}}}]}, {"ruleId": "scanner-b3aea0a85250129e", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "88e4cf7bad17ed47", "scanner": "scanner-primary", "fingerprint": "b3aea0a85250129e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/wisptermctl-release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cec841feb47f58c9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "22f3b2c4c1bdb7a4", "scanner": "scanner-primary", "fingerprint": "cec841feb47f58c9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/windows-release.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-cec841feb47f58c9", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8b2631827fcf1b3c", "scanner": "scanner-primary", "fingerprint": "cec841feb47f58c9", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/windows-release.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-cec841feb47f58c9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "59bc9c5392692cff", "scanner": "scanner-primary", "fingerprint": "cec841feb47f58c9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/windows-release.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-cec841feb47f58c9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7628c771f1b8207a", "scanner": "scanner-primary", "fingerprint": "cec841feb47f58c9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/windows-release.yml"}, "region": {"startLine": 192}}}]}, {"ruleId": "scanner-cec841feb47f58c9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7628c771f1b8207a", "scanner": "scanner-primary", "fingerprint": "cec841feb47f58c9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/windows-release.yml"}, "region": {"startLine": 199}}}]}, {"ruleId": "scanner-cec841feb47f58c9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7628c771f1b8207a", "scanner": "scanner-primary", "fingerprint": "cec841feb47f58c9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/windows-release.yml"}, "region": {"startLine": 206}}}]}, {"ruleId": "scanner-cec841feb47f58c9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7628c771f1b8207a", "scanner": "scanner-primary", "fingerprint": "cec841feb47f58c9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/windows-release.yml"}, "region": {"startLine": 213}}}]}, {"ruleId": "scanner-41fdb0d1c285948d", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "dfd214078c2175e0", "scanner": "scanner-primary", "fingerprint": "41fdb0d1c285948d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/windows-release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ed258c862e78e88e", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "95c31b4023e6e3aa", "scanner": "scanner-primary", "fingerprint": "ed258c862e78e88e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/linux-release.yml"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-ed258c862e78e88e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "03c8eeb7b0b41b21", "scanner": "scanner-primary", "fingerprint": "ed258c862e78e88e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/linux-release.yml"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-38b8ccbb498b5246", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "ade0d551bcb25e0f", "scanner": "scanner-primary", "fingerprint": "38b8ccbb498b5246", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/linux-release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0fb8c24a130cdd0a", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "38cf1c8b667d348e", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7b2f6f2d816930a2", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "25e1fa3783e7cb32", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-448d8837178ae57a", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "13af6451e15656fc", "scanner": "scanner-primary", "fingerprint": "448d8837178ae57a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d6a9a38ac60e4681", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c5c269f52432e821", "scanner": "scanner-primary", "fingerprint": "d6a9a38ac60e4681", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/macos-debug.yml"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-d6a9a38ac60e4681", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "10735146ba0e136c", "scanner": "scanner-primary", "fingerprint": "d6a9a38ac60e4681", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/macos-debug.yml"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-d6a9a38ac60e4681", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a0380f1e76e4f9a8", "scanner": "scanner-primary", "fingerprint": "d6a9a38ac60e4681", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/macos-debug.yml"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-d6a9a38ac60e4681", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0e3b3384dae77abc", "scanner": "scanner-primary", "fingerprint": "d6a9a38ac60e4681", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/macos-debug.yml"}, "region": {"startLine": 117}}}]}, {"ruleId": "scanner-c6e2985d5455cffb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3c5cc60921c84b37", "scanner": "scanner-primary", "fingerprint": "c6e2985d5455cffb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/macos-release-x86_64.yml"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-c6e2985d5455cffb", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fadcf3ecdb48bedb", "scanner": "scanner-primary", "fingerprint": "c6e2985d5455cffb", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/macos-release-x86_64.yml"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-c6e2985d5455cffb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e42d697fb536be5f", "scanner": "scanner-primary", "fingerprint": "c6e2985d5455cffb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/macos-release-x86_64.yml"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-c6e2985d5455cffb", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cff6b23955e7c6ad", "scanner": "scanner-primary", "fingerprint": "c6e2985d5455cffb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/macos-release-x86_64.yml"}, "region": {"startLine": 188}}}]}, {"ruleId": "scanner-e1cd0399b583c635", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "c72cdb1f238bdd32", "scanner": "scanner-primary", "fingerprint": "e1cd0399b583c635", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/macos-release-x86_64.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1559d882daf1bd74", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fc6b5b9639ef5768", "scanner": "scanner-primary", "fingerprint": "1559d882daf1bd74", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/windows-debug.yml"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-1559d882daf1bd74", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "73d2127635a98557", "scanner": "scanner-primary", "fingerprint": "1559d882daf1bd74", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/windows-debug.yml"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-1559d882daf1bd74", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e109013a3735e992", "scanner": "scanner-primary", "fingerprint": "1559d882daf1bd74", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/windows-debug.yml"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-1559d882daf1bd74", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9256ef8139cf3e07", "scanner": "scanner-primary", "fingerprint": "1559d882daf1bd74", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/windows-debug.yml"}, "region": {"startLine": 72}}}]}, {"ruleId": "scanner-391adb6592443f79", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3e7f1f8c4ce58050", "scanner": "scanner-primary", "fingerprint": "391adb6592443f79", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/macos-release.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-391adb6592443f79", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1b56d48241f7975e", "scanner": "scanner-primary", "fingerprint": "391adb6592443f79", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/macos-release.yml"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-391adb6592443f79", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "83439641c0e63b93", "scanner": "scanner-primary", "fingerprint": "391adb6592443f79", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/macos-release.yml"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-391adb6592443f79", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4cf169ea8b543e68", "scanner": "scanner-primary", "fingerprint": "391adb6592443f79", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/macos-release.yml"}, "region": {"startLine": 167}}}]}, {"ruleId": "scanner-391adb6592443f79", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3e7f1f8c4ce58050", "scanner": "scanner-primary", "fingerprint": "391adb6592443f79", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/macos-release.yml"}, "region": {"startLine": 188}}}]}, {"ruleId": "scanner-391adb6592443f79", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "60f09c43efc5cd04", "scanner": "scanner-primary", "fingerprint": "391adb6592443f79", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/macos-release.yml"}, "region": {"startLine": 191}}}]}, {"ruleId": "scanner-dee297f21d82e978", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "9227157b5fcbcb3f", "scanner": "scanner-primary", "fingerprint": "dee297f21d82e978", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/macos-release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-92446d7cbb9ca7de", "level": "note", "message": {"text": "Very large file: docs/themes-data.js (11781 lines)"}, "properties": {"repobilityId": "e2ea116535307ff5", "scanner": "scanner-primary", "fingerprint": "92446d7cbb9ca7de", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "772725e4ea9c246b", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "4cf6cb84d34c5fd3", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "1de48109dd236eb9", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "e104e7b2871236da", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-0a2d487057f9e738", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: plugins/skills/inspect-computer-config/SKILL.md"}, "properties": {"repobilityId": "8d1ecf0e21a995c0", "scanner": "scanner-primary", "fingerprint": "0a2d487057f9e738", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "plugins/skills/inspect-computer-config/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fe825f204c5b4152", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 remote/src/worker.ts:34"}, "properties": {"repobilityId": "20653d919c8bb234", "scanner": "scanner-primary", "fingerprint": "fe825f204c5b4152", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1bd0cd4a13693659", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 tools/kitty_graphics.py:87"}, "properties": {"repobilityId": "ff8d77259a5f8f64", "scanner": "scanner-primary", "fingerprint": "1bd0cd4a13693659", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b334d875f2339fa1", "level": "note", "message": {"text": "5 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "faa38682016f5d53", "scanner": "scanner-primary", "fingerprint": "b334d875f2339fa1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}]}]}