{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-bead75b0f9233e05", "name": "No API endpoints detected", "shortDescription": {"text": "No API endpoints detected"}, "fullDescription": {"text": "The scanner did not find FastAPI/Flask/Express/NestJS/GraphQL/gRPC routes. If this repo exposes APIs, the framework may be unsupported."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d3463be15dfcf469", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 src/features/community/pages/community-posts-page.tsx:1166", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 src/features/community/pages/community-posts-page.tsx:1166"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aa3f48cee8bdec71", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 src/shared/ui/html-preview-modal/html-preview-modal.tsx:58", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 src/shared/ui/html-preview-modal/html-preview-modal.tsx:58"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-166dff3c3df6a10e", "name": "ORM models found but no DB engine detected", "shortDescription": {"text": "ORM models found but no DB engine detected"}, "fullDescription": {"text": "The repo defines tables/models but no DB connection string was found. Likely lives in env vars or a config file the scanner didn't read."}, "properties": {"scanner": "scanner-primary", "layer": "data", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7176e5d95d18d844", "name": "Runtime dotenv file present in repo: .env", "shortDescription": {"text": "Runtime dotenv file present in repo: .env"}, "fullDescription": {"text": "`.env` looks like a runtime dotenv file. It contains secret-looking assignments for REACT_APP_TINYMCE_API_KEY. Move real values to a secret manager and keep only `.env.example` style templates in source control."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-0e89b40f1600217a", "name": "Insecure pattern 'dangerous_innerhtml' in src/features/community/pages/community-posts-page.tsx:1166", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in src/features/community/pages/community-posts-page.tsx:1166"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-414164dfc87d6d84", "name": "Insecure pattern 'dangerous_innerhtml' in src/shared/ui/html-preview-modal/html-preview-modal.tsx:58", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in src/shared/ui/html-preview-modal/html-preview-modal.tsx:58"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cb639d9a10a47b23", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-63dc52d489b6e41e", "name": "Very large file: src/features/message/pages/message-groups-page.tsx (2037 lines)", "shortDescription": {"text": "Very large file: src/features/message/pages/message-groups-page.tsx (2037 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a2ae810c080de522", "name": "Very large file: src/features/operation/pages/operation-policies-page.tsx (1775 lines)", "shortDescription": {"text": "Very large file: src/features/operation/pages/operation-policies-page.tsx (1775 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1e02e420f6bef85c", "name": "Very large file: src/features/operation/pages/operation-faq-page.tsx (2378 lines)", "shortDescription": {"text": "Very large file: src/features/operation/pages/operation-faq-page.tsx (2378 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f377e665afe8f885", "name": "Very large file: src/features/operation/pages/operation-event-create-page.tsx (1539 lines)", "shortDescription": {"text": "Very large file: src/features/operation/pages/operation-event-create-page.tsx (1539 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-844210fe8a68c2df", "name": "Very large file: src/features/commerce/pages/commerce-coupon-create-page.tsx (1885 lines)", "shortDescription": {"text": "Very large file: src/features/commerce/pages/commerce-coupon-create-page.tsx (1885 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fe1a590b291a66ff", "name": "Very large file: src/features/commerce/pages/commerce-coupons-page.tsx (2386 lines)", "shortDescription": {"text": "Very large file: src/features/commerce/pages/commerce-coupons-page.tsx (2386 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ebed2dc0c48f386", "name": "Very large file: src/features/commerce/pages/commerce-points-page.tsx (3023 lines)", "shortDescription": {"text": "Very large file: src/features/commerce/pages/commerce-points-page.tsx (3023 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5499ead050fbf92a", "name": "Very large file: src/features/system/pages/system-metadata-page.tsx (2256 lines)", "shortDescription": {"text": "Very large file: src/features/system/pages/system-metadata-page.tsx (2256 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "23 tests / 182 src (ratio 0.13)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 34 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 206 placeholder/mock markers across 56 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c5f98b152cddb6d", "name": "Agent authority lacks a verifier contract: .claude/launch.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/launch.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f8a90d324aa58453", "name": "Commented-code block (8 lines) in scripts/etl/verify-backfill.mjs:2", "shortDescription": {"text": "Commented-code block (8 lines) in scripts/etl/verify-backfill.mjs:2"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5750da0a6a55eae5", "name": "Commented-code block (10 lines) in scripts/db/p1-smoke.mjs:2", "shortDescription": {"text": "Commented-code block (10 lines) in scripts/db/p1-smoke.mjs:2"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7e1a671933310d06", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/db/p1-smoke.mjs:42", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/db/p1-smoke.mjs:42"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ac8a943e0615d32", "name": "Commented-code block (8 lines) in scripts/db/notification-rls-smoke.mjs:2", "shortDescription": {"text": "Commented-code block (8 lines) in scripts/db/notification-rls-smoke.mjs:2"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-52d95d6c6b052184", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/db/notification-rls-smoke.mjs:53", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/db/notification-rls-smoke.mjs:53"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1d2dba0b2fc681d6", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/db/create-e2e-admin.mjs:28", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/db/create-e2e-admin.mjs:28"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3dbeba2dc46e9e5a", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/db/schema-snapshot.mjs:17", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/db/schema-snapshot.mjs:17"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4f15160e10750d1e", "name": "Commented-code block (5 lines) in scripts/db/migrate-core.mjs:1", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/db/migrate-core.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8b18d25f0f10f66e", "name": "Commented-code block (5 lines) in src/features/message/pages/message-history-page.tsx:771", "shortDescription": {"text": "Commented-code block (5 lines) in src/features/message/pages/message-history-page.tsx:771"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d6ff10bbd5710a74", "name": "Commented-code block (5 lines) in src/features/assessment/api/topik-writing-question-bank-service.ts:437", "shortDescription": {"text": "Commented-code block (5 lines) in src/features/assessment/api/topik-writing-question-bank-service.ts:437"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d0b17c8c07a7421d", "name": "8 env vars used in code but missing from .env.example", "shortDescription": {"text": "8 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `E2E_ADMIN_EMAIL`, `E2E_ADMIN_PASSWORD`, `E2E_NTF_PASSWORD`, `E2E_USER_EMAIL`, `E2E_USER_PASSWORD`, `SUPABASE_ACCESS_TOKEN`, `SUPABASE_PROJECT_REF`, `SUPABASE_SECRET_KEY`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24622"}, "properties": {"repository": "blackstarzck/topik-ai", "repoUrl": "https://github.com/blackstarzck/topik-ai", "branch": "main"}, "results": [{"ruleId": "scanner-bead75b0f9233e05", "level": "none", "message": {"text": "No API endpoints detected"}, "properties": {"repobilityId": "0f8bb852027c38f8", "scanner": "scanner-primary", "fingerprint": "bead75b0f9233e05", "layer": "api", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-d3463be15dfcf469", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 src/features/community/pages/community-posts-page.tsx:1166"}, "properties": {"repobilityId": "e2640eb32e0602f1", "scanner": "scanner-primary", "fingerprint": "d3463be15dfcf469", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-aa3f48cee8bdec71", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 src/shared/ui/html-preview-modal/html-preview-modal.tsx:58"}, "properties": {"repobilityId": "560478cdb2b5ee78", "scanner": "scanner-primary", "fingerprint": "aa3f48cee8bdec71", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-166dff3c3df6a10e", "level": "warning", "message": {"text": "ORM models found but no DB engine detected"}, "properties": {"repobilityId": "cda36de65e114635", "scanner": "scanner-primary", "fingerprint": "166dff3c3df6a10e", "layer": "data", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-7176e5d95d18d844", "level": "error", "message": {"text": "Runtime dotenv file present in repo: .env"}, "properties": {"repobilityId": "4b9c737a445874ba", "scanner": "scanner-primary", "fingerprint": "7176e5d95d18d844", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets", "config", "env-file", "runtime-env", "env_file_with_secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".env"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0e89b40f1600217a", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in src/features/community/pages/community-posts-page.tsx:1166"}, "properties": {"repobilityId": "f10ec5df89f09ba2", "scanner": "scanner-primary", "fingerprint": "0e89b40f1600217a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/features/community/pages/community-posts-page.tsx"}, "region": {"startLine": 1166}}}]}, {"ruleId": "scanner-414164dfc87d6d84", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in src/shared/ui/html-preview-modal/html-preview-modal.tsx:58"}, "properties": {"repobilityId": "9c801616019f3e03", "scanner": "scanner-primary", "fingerprint": "414164dfc87d6d84", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/shared/ui/html-preview-modal/html-preview-modal.tsx"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-cb639d9a10a47b23", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "edeab51902066991", "scanner": "scanner-primary", "fingerprint": "cb639d9a10a47b23", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-63dc52d489b6e41e", "level": "note", "message": {"text": "Very large file: src/features/message/pages/message-groups-page.tsx (2037 lines)"}, "properties": {"repobilityId": "299607805d873d18", "scanner": "scanner-primary", "fingerprint": "63dc52d489b6e41e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a2ae810c080de522", "level": "note", "message": {"text": "Very large file: src/features/operation/pages/operation-policies-page.tsx (1775 lines)"}, "properties": {"repobilityId": "4c292253a5a4fe65", "scanner": "scanner-primary", "fingerprint": "a2ae810c080de522", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1e02e420f6bef85c", "level": "note", "message": {"text": "Very large file: src/features/operation/pages/operation-faq-page.tsx (2378 lines)"}, "properties": {"repobilityId": "a5613bb795e875c5", "scanner": "scanner-primary", "fingerprint": "1e02e420f6bef85c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f377e665afe8f885", "level": "note", "message": {"text": "Very large file: src/features/operation/pages/operation-event-create-page.tsx (1539 lines)"}, "properties": {"repobilityId": "253b0900cfdc8a04", "scanner": "scanner-primary", "fingerprint": "f377e665afe8f885", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-844210fe8a68c2df", "level": "note", "message": {"text": "Very large file: src/features/commerce/pages/commerce-coupon-create-page.tsx (1885 lines)"}, "properties": {"repobilityId": "08a20927f7556201", "scanner": "scanner-primary", "fingerprint": "844210fe8a68c2df", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-fe1a590b291a66ff", "level": "note", "message": {"text": "Very large file: src/features/commerce/pages/commerce-coupons-page.tsx (2386 lines)"}, "properties": {"repobilityId": "8c499e71411dcf06", "scanner": "scanner-primary", "fingerprint": "fe1a590b291a66ff", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ebed2dc0c48f386", "level": "note", "message": {"text": "Very large file: src/features/commerce/pages/commerce-points-page.tsx (3023 lines)"}, "properties": {"repobilityId": "0478c95d97c5d911", "scanner": "scanner-primary", "fingerprint": "3ebed2dc0c48f386", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5499ead050fbf92a", "level": "note", "message": {"text": "Very large file: src/features/system/pages/system-metadata-page.tsx (2256 lines)"}, "properties": {"repobilityId": "6ddd0852f1dfff09", "scanner": "scanner-primary", "fingerprint": "5499ead050fbf92a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "82c835011a4402b6", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "a7b3bedda808389c", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "35c8af3fcedfd93d", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "9b9777e34470e474", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "5edfc1ab677f6e2f", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "a4de574a8fcc1815", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2c5f98b152cddb6d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/launch.json"}, "properties": {"repobilityId": "0de48c0f4ab303d8", "scanner": "scanner-primary", "fingerprint": "2c5f98b152cddb6d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/launch.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f8a90d324aa58453", "level": "none", "message": {"text": "Commented-code block (8 lines) in scripts/etl/verify-backfill.mjs:2"}, "properties": {"repobilityId": "7b39b60517a77045", "scanner": "scanner-primary", "fingerprint": "f8a90d324aa58453", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5750da0a6a55eae5", "level": "none", "message": {"text": "Commented-code block (10 lines) in scripts/db/p1-smoke.mjs:2"}, "properties": {"repobilityId": "8cb4cd28bb0d826e", "scanner": "scanner-primary", "fingerprint": "5750da0a6a55eae5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7e1a671933310d06", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/db/p1-smoke.mjs:42"}, "properties": {"repobilityId": "cbef1ba1df0843c7", "scanner": "scanner-primary", "fingerprint": "7e1a671933310d06", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3ac8a943e0615d32", "level": "none", "message": {"text": "Commented-code block (8 lines) in scripts/db/notification-rls-smoke.mjs:2"}, "properties": {"repobilityId": "fa3936b8497bb187", "scanner": "scanner-primary", "fingerprint": "3ac8a943e0615d32", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-52d95d6c6b052184", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/db/notification-rls-smoke.mjs:53"}, "properties": {"repobilityId": "b9f6631535b7c961", "scanner": "scanner-primary", "fingerprint": "52d95d6c6b052184", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1d2dba0b2fc681d6", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/db/create-e2e-admin.mjs:28"}, "properties": {"repobilityId": "a70880dad9f65baa", "scanner": "scanner-primary", "fingerprint": "1d2dba0b2fc681d6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3dbeba2dc46e9e5a", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/db/schema-snapshot.mjs:17"}, "properties": {"repobilityId": "9fdf28582eeced4e", "scanner": "scanner-primary", "fingerprint": "3dbeba2dc46e9e5a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-4f15160e10750d1e", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/db/migrate-core.mjs:1"}, "properties": {"repobilityId": "7b3c3be612844c7d", "scanner": "scanner-primary", "fingerprint": "4f15160e10750d1e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8b18d25f0f10f66e", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/features/message/pages/message-history-page.tsx:771"}, "properties": {"repobilityId": "f355edecb07f322e", "scanner": "scanner-primary", "fingerprint": "8b18d25f0f10f66e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d6ff10bbd5710a74", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/features/assessment/api/topik-writing-question-bank-service.ts:437"}, "properties": {"repobilityId": "5e253a11b1ef8daf", "scanner": "scanner-primary", "fingerprint": "d6ff10bbd5710a74", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d0b17c8c07a7421d", "level": "note", "message": {"text": "8 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "17fe720e8247f9df", "scanner": "scanner-primary", "fingerprint": "d0b17c8c07a7421d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}]}]}