{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-ff11f9bc5f3ff486", "name": "Icon-only button without accessible name \u2014 src/desktop/renderer.ts:963", "shortDescription": {"text": "Icon-only button without accessible name \u2014 src/desktop/renderer.ts:963"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-f340a7a42aa987d2", "name": "Privileged port 256 in use", "shortDescription": {"text": "Privileged port 256 in use"}, "fullDescription": {"text": "Port 256 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-53734da4e4dcf3b6", "name": "Privileged port 551 in use", "shortDescription": {"text": "Privileged port 551 in use"}, "fullDescription": {"text": "Port 551 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-84efe6e1cbdf7b01", "name": "Possible secret in tests/integration/hook-contract.test.ts", "shortDescription": {"text": "Possible secret in tests/integration/hook-contract.test.ts"}, "fullDescription": {"text": "Detected 1 occurrence(s) matching openai_or_anthropic_key. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 0.95}}, {"id": "scanner-ecfcac4535449eba", "name": "Possible secret in tests/integration/ecosystem-dogfood.test.ts", "shortDescription": {"text": "Possible secret in tests/integration/ecosystem-dogfood.test.ts"}, "fullDescription": {"text": "Detected 2 occurrence(s) matching openai_or_anthropic_key. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 0.95}}, {"id": "scanner-90a1657ff31ff888", "name": "Possible secret in tests/integration/workflow-contract.test.ts", "shortDescription": {"text": "Possible secret in tests/integration/workflow-contract.test.ts"}, "fullDescription": {"text": "Detected 1 occurrence(s) matching openai_or_anthropic_key. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 0.95}}, {"id": "scanner-65a12707cdae8830", "name": "Possible secret in tests/unit/tui-shell.test.ts", "shortDescription": {"text": "Possible secret in tests/unit/tui-shell.test.ts"}, "fullDescription": {"text": "Detected 2 occurrence(s) matching openai_or_anthropic_key. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 0.95}}, {"id": "scanner-820534b57353ae73", "name": "Possible secret in tests/unit/hook-contract.test.ts", "shortDescription": {"text": "Possible secret in tests/unit/hook-contract.test.ts"}, "fullDescription": {"text": "Detected 2 occurrence(s) matching openai_or_anthropic_key. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 0.95}}, {"id": "scanner-bc0421a843e39849", "name": "Possible secret in tests/unit/result-handoff.test.ts", "shortDescription": {"text": "Possible secret in tests/unit/result-handoff.test.ts"}, "fullDescription": {"text": "Detected 2 occurrence(s) matching openai_or_anthropic_key. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 0.95}}, {"id": "scanner-20aacb9e26d8aa3e", "name": "Possible secret in tests/unit/task-runtime.test.ts", "shortDescription": {"text": "Possible secret in tests/unit/task-runtime.test.ts"}, "fullDescription": {"text": "Detected 2 occurrence(s) matching openai_or_anthropic_key. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 0.95}}, {"id": "scanner-69c1f30f4a53f240", "name": "Possible secret in tests/unit/workflow-runner.test.ts", "shortDescription": {"text": "Possible secret in tests/unit/workflow-runner.test.ts"}, "fullDescription": {"text": "Detected 4 occurrence(s) matching openai_or_anthropic_key. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 0.95}}, {"id": "scanner-75a85ae4e2122778", "name": "Possible secret in tests/unit/repo-map.test.ts", "shortDescription": {"text": "Possible secret in tests/unit/repo-map.test.ts"}, "fullDescription": {"text": "Detected 1 occurrence(s) matching openai_or_anthropic_key. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 0.95}}, {"id": "scanner-0afbc8531ec6be85", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/desktop/renderer-entry.ts:45", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/desktop/renderer-entry.ts:45"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-672fd13d61500c75", "name": "Very large file: tests/unit/tui-shell.test.ts (1850 lines)", "shortDescription": {"text": "Very large file: tests/unit/tui-shell.test.ts (1850 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0bcdaa478c7e5bba", "name": "Very large file: src/tui-shell.ts (4296 lines)", "shortDescription": {"text": "Very large file: src/tui-shell.ts (4296 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6d61e134b69f9840", "name": "Very large file: src/index.ts (3324 lines)", "shortDescription": {"text": "Very large file: src/index.ts (3324 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ffb6daf4fae48543", "name": "Very large file: src/desktop/renderer.ts (1017 lines)", "shortDescription": {"text": "Very large file: src/desktop/renderer.ts (1017 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-de42be96f10ea72a", "name": "Very large file: src/desktop/service.ts (1453 lines)", "shortDescription": {"text": "Very large file: src/desktop/service.ts (1453 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 5 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 15 placeholder/mock markers across 8 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9d79c4077342a7d0", "name": "Runtime service client appears to use placeholder configuration", "shortDescription": {"text": "Runtime service client appears to use placeholder configuration"}, "fullDescription": {"text": "A runtime source file appears to wire Supabase/Firebase/AI/payment-style clients to placeholder URLs, keys, or fallback values. In the Fable corpus this often means the UI/API shape is present while the backend service is not actually configured."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-33527b0b9ea74808", "name": "Legacy-named symbol `isTooOld` in src/artifact-retention.ts:87", "shortDescription": {"text": "Legacy-named symbol `isTooOld` in src/artifact-retention.ts:87"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b3951538d1299980", "name": "Vulnerable dependency postcss 8.5.19: GHSA-fxqj-rqcc-2cmp", "shortDescription": {"text": "Vulnerable dependency postcss 8.5.19: GHSA-fxqj-rqcc-2cmp"}, "fullDescription": {"text": "OSV.dev reports `postcss` at version `8.5.19` (resolved in `package-lock.json`) is affected by GHSA-fxqj-rqcc-2cmp (aka CVE-2026-69153).\nNote: `postcss` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nPostCSS: incomplete fix of GHSA-6g55-p6wh-862q \u2014 attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset\n\nAliases: CVE-2026-69153\nAdvisory: https://osv.dev/vulnerability/GHSA-fxqj-rqcc-2cmp\nFix: upgrade `postcss` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-f40533a5990997df", "name": "Vulnerable dependency undici 7.28.0: GHSA-4cwx-7wf7-3272", "shortDescription": {"text": "Vulnerable dependency undici 7.28.0: GHSA-4cwx-7wf7-3272"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `7.28.0` (resolved in `package-lock.json`) is affected by GHSA-4cwx-7wf7-3272 (aka CVE-2026-13697).\nNote: `undici` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nundici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives\n\nAliases: CVE-2026-13697\nAdvisory: https://osv.dev/vulnerability/GHSA-4cwx-7wf7-3272\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-c1565ef968da158b", "name": "Vulnerable dependency undici 7.28.0: GHSA-8xcm-r25x-g524", "shortDescription": {"text": "Vulnerable dependency undici 7.28.0: GHSA-8xcm-r25x-g524"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `7.28.0` (resolved in `package-lock.json`) is affected by GHSA-8xcm-r25x-g524 (aka CVE-2026-16728).\nNote: `undici` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nundici vulnerable to downstream response desynchronization via retry interceptor\n\nAliases: CVE-2026-16728\nAdvisory: https://osv.dev/vulnerability/GHSA-8xcm-r25x-g524\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-cc69c4dfc89df563", "name": "Vulnerable dependency undici 7.28.0: GHSA-jr45-8vmc-qm54", "shortDescription": {"text": "Vulnerable dependency undici 7.28.0: GHSA-jr45-8vmc-qm54"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `7.28.0` (resolved in `package-lock.json`) is affected by GHSA-jr45-8vmc-qm54 (aka CVE-2026-14643).\nNote: `undici` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nundici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives\n\nAliases: CVE-2026-14643\nAdvisory: https://osv.dev/vulnerability/GHSA-jr45-8vmc-qm54\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-180c8215d6104e3e", "name": "Vulnerable dependency undici 7.28.0: GHSA-m8rv-5g2x-5cg5", "shortDescription": {"text": "Vulnerable dependency undici 7.28.0: GHSA-m8rv-5g2x-5cg5"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `7.28.0` (resolved in `package-lock.json`) is affected by GHSA-m8rv-5g2x-5cg5 (aka CVE-2026-15157).\nNote: `undici` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nundici vulnerable to CRLF Injection via blob-like body 'type' property\n\nAliases: CVE-2026-15157\nAdvisory: https://osv.dev/vulnerability/GHSA-m8rv-5g2x-5cg5\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-0ba8a10aeaabe4b4", "name": "Vulnerable dependency undici 7.28.0: GHSA-v3r7-h72x-cjcm", "shortDescription": {"text": "Vulnerable dependency undici 7.28.0: GHSA-v3r7-h72x-cjcm"}, "fullDescription": {"text": "OSV.dev reports `undici` at version `7.28.0` (resolved in `package-lock.json`) is affected by GHSA-v3r7-h72x-cjcm (aka CVE-2026-16729).\nNote: `undici` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nundici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields\n\nAliases: CVE-2026-16729\nAdvisory: https://osv.dev/vulnerability/GHSA-v3r7-h72x-cjcm\nFix: upgrade `undici` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-a2f2f8d1a34b7012", "name": "Dependency commander is two or more major versions behind", "shortDescription": {"text": "Dependency commander is two or more major versions behind"}, "fullDescription": {"text": "`commander` is pinned at `13.1.0` in `package.json` while the latest release on the npm registry is `15.0.0` \u2014 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `commander` to `15.0.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-93d9b19eb2da6ec2", "name": "Dependency openai is two or more major versions behind", "shortDescription": {"text": "Dependency openai is two or more major versions behind"}, "fullDescription": {"text": "`openai` is pinned at `4.96.0` in `package.json` while the latest release on the npm registry is `7.4.0` \u2014 3 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `openai` to `7.4.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-d637c276d64febc3", "name": "Dependency zod is a major version behind", "shortDescription": {"text": "Dependency zod is a major version behind"}, "fullDescription": {"text": "`zod` is pinned at `3.24.4` in `package.json` while the latest release on the npm registry is `4.4.3` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `zod` to `4.4.3`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}]}}, "automationDetails": {"id": "repobility/30806"}, "properties": {"repository": "qwen-code-dev-bot/oh-my-cli", "repoUrl": "https://github.com/qwen-code-dev-bot/oh-my-cli", "branch": "main"}, "results": [{"ruleId": "scanner-ff11f9bc5f3ff486", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 src/desktop/renderer.ts:963"}, "properties": {"repobilityId": "d0f24b88973f0ca7", "scanner": "scanner-primary", "fingerprint": "ff11f9bc5f3ff486", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.button.no-label"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/desktop/renderer.ts"}, "region": {"startLine": 963}}}]}, {"ruleId": "scanner-f340a7a42aa987d2", "level": "warning", "message": {"text": "Privileged port 256 in use"}, "properties": {"repobilityId": "0ec1f2d0c9e6da94", "scanner": "scanner-primary", "fingerprint": "f340a7a42aa987d2", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-53734da4e4dcf3b6", "level": "warning", "message": {"text": "Privileged port 551 in use"}, "properties": {"repobilityId": "0c5c0c931ec6b5b6", "scanner": "scanner-primary", "fingerprint": "53734da4e4dcf3b6", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-84efe6e1cbdf7b01", "level": "error", "message": {"text": "Possible secret in tests/integration/hook-contract.test.ts"}, "properties": {"repobilityId": "a0140f8aa17dfe8d", "scanner": "scanner-primary", "fingerprint": "84efe6e1cbdf7b01", "layer": "security", "severity": "critical", "confidence": 0.95, "tags": ["secrets", "openai_or_anthropic_key", "high-confidence-secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/integration/hook-contract.test.ts"}, "region": {"startLine": 261}}}]}, {"ruleId": "scanner-ecfcac4535449eba", "level": "error", "message": {"text": "Possible secret in tests/integration/ecosystem-dogfood.test.ts"}, "properties": {"repobilityId": "ca8d7eb21f7bca43", "scanner": "scanner-primary", "fingerprint": "ecfcac4535449eba", "layer": "security", "severity": "critical", "confidence": 0.95, "tags": ["secrets", "openai_or_anthropic_key", "high-confidence-secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/integration/ecosystem-dogfood.test.ts"}, "region": {"startLine": 330}}}]}, {"ruleId": "scanner-90a1657ff31ff888", "level": "error", "message": {"text": "Possible secret in tests/integration/workflow-contract.test.ts"}, "properties": {"repobilityId": "1a66349747966c16", "scanner": "scanner-primary", "fingerprint": "90a1657ff31ff888", "layer": "security", "severity": "critical", "confidence": 0.95, "tags": ["secrets", "openai_or_anthropic_key", "high-confidence-secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/integration/workflow-contract.test.ts"}, "region": {"startLine": 274}}}]}, {"ruleId": "scanner-65a12707cdae8830", "level": "error", "message": {"text": "Possible secret in tests/unit/tui-shell.test.ts"}, "properties": {"repobilityId": "798bf6bd3454aefd", "scanner": "scanner-primary", "fingerprint": "65a12707cdae8830", "layer": "security", "severity": "critical", "confidence": 0.95, "tags": ["secrets", "openai_or_anthropic_key", "high-confidence-secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/unit/tui-shell.test.ts"}, "region": {"startLine": 1154}}}]}, {"ruleId": "scanner-820534b57353ae73", "level": "error", "message": {"text": "Possible secret in tests/unit/hook-contract.test.ts"}, "properties": {"repobilityId": "5922ac0ba1da831e", "scanner": "scanner-primary", "fingerprint": "820534b57353ae73", "layer": "security", "severity": "critical", "confidence": 0.95, "tags": ["secrets", "openai_or_anthropic_key", "high-confidence-secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/unit/hook-contract.test.ts"}, "region": {"startLine": 293}}}]}, {"ruleId": "scanner-bc0421a843e39849", "level": "error", "message": {"text": "Possible secret in tests/unit/result-handoff.test.ts"}, "properties": {"repobilityId": "8e5072cb4a0bd189", "scanner": "scanner-primary", "fingerprint": "bc0421a843e39849", "layer": "security", "severity": "critical", "confidence": 0.95, "tags": ["secrets", "openai_or_anthropic_key", "high-confidence-secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/unit/result-handoff.test.ts"}, "region": {"startLine": 86}}}]}, {"ruleId": "scanner-20aacb9e26d8aa3e", "level": "error", "message": {"text": "Possible secret in tests/unit/task-runtime.test.ts"}, "properties": {"repobilityId": "cc7e58223619ed74", "scanner": "scanner-primary", "fingerprint": "20aacb9e26d8aa3e", "layer": "security", "severity": "critical", "confidence": 0.95, "tags": ["secrets", "openai_or_anthropic_key", "high-confidence-secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/unit/task-runtime.test.ts"}, "region": {"startLine": 294}}}]}, {"ruleId": "scanner-69c1f30f4a53f240", "level": "error", "message": {"text": "Possible secret in tests/unit/workflow-runner.test.ts"}, "properties": {"repobilityId": "693428b4c7bce5a1", "scanner": "scanner-primary", "fingerprint": "69c1f30f4a53f240", "layer": "security", "severity": "critical", "confidence": 0.95, "tags": ["secrets", "openai_or_anthropic_key", "high-confidence-secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/unit/workflow-runner.test.ts"}, "region": {"startLine": 120}}}]}, {"ruleId": "scanner-75a85ae4e2122778", "level": "error", "message": {"text": "Possible secret in tests/unit/repo-map.test.ts"}, "properties": {"repobilityId": "73dad9cdafbeada6", "scanner": "scanner-primary", "fingerprint": "75a85ae4e2122778", "layer": "security", "severity": "critical", "confidence": 0.95, "tags": ["secrets", "openai_or_anthropic_key", "high-confidence-secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/unit/repo-map.test.ts"}, "region": {"startLine": 116}}}]}, {"ruleId": "scanner-0afbc8531ec6be85", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/desktop/renderer-entry.ts:45"}, "properties": {"repobilityId": "2c10055af1e54a8c", "scanner": "scanner-primary", "fingerprint": "0afbc8531ec6be85", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/desktop/renderer-entry.ts"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-672fd13d61500c75", "level": "note", "message": {"text": "Very large file: tests/unit/tui-shell.test.ts (1850 lines)"}, "properties": {"repobilityId": "05c3035cc6bb7c62", "scanner": "scanner-primary", "fingerprint": "672fd13d61500c75", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0bcdaa478c7e5bba", "level": "note", "message": {"text": "Very large file: src/tui-shell.ts (4296 lines)"}, "properties": {"repobilityId": "adf4207bbc166393", "scanner": "scanner-primary", "fingerprint": "0bcdaa478c7e5bba", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6d61e134b69f9840", "level": "note", "message": {"text": "Very large file: src/index.ts (3324 lines)"}, "properties": {"repobilityId": "25727599e08a7f66", "scanner": "scanner-primary", "fingerprint": "6d61e134b69f9840", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ffb6daf4fae48543", "level": "note", "message": {"text": "Very large file: src/desktop/renderer.ts (1017 lines)"}, "properties": {"repobilityId": "24b33f78895fbd29", "scanner": "scanner-primary", "fingerprint": "ffb6daf4fae48543", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-de42be96f10ea72a", "level": "note", "message": {"text": "Very large file: src/desktop/service.ts (1453 lines)"}, "properties": {"repobilityId": "2ff67ea77b308356", "scanner": "scanner-primary", "fingerprint": "de42be96f10ea72a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "11af07d1821da313", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "c6182308f5a38d6e", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-9d79c4077342a7d0", "level": "warning", "message": {"text": "Runtime service client appears to use placeholder configuration"}, "properties": {"repobilityId": "8520315fa902ae0c", "scanner": "scanner-primary", "fingerprint": "9d79c4077342a7d0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "runtime-config", "service-client", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "f6265bd87aca666a", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-33527b0b9ea74808", "level": "note", "message": {"text": "Legacy-named symbol `isTooOld` in src/artifact-retention.ts:87"}, "properties": {"repobilityId": "5485bd69617a2251", "scanner": "scanner-primary", "fingerprint": "33527b0b9ea74808", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b3951538d1299980", "level": "warning", "message": {"text": "Vulnerable dependency postcss 8.5.19: GHSA-fxqj-rqcc-2cmp"}, "properties": {"repobilityId": "54fbfb419cfcac9c", "scanner": "scanner-primary", "fingerprint": "b3951538d1299980", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-fxqj-rqcc-2cmp", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f40533a5990997df", "level": "error", "message": {"text": "Vulnerable dependency undici 7.28.0: GHSA-4cwx-7wf7-3272"}, "properties": {"repobilityId": "a5c1a1da5c231d9f", "scanner": "scanner-primary", "fingerprint": "f40533a5990997df", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-4cwx-7wf7-3272", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c1565ef968da158b", "level": "warning", "message": {"text": "Vulnerable dependency undici 7.28.0: GHSA-8xcm-r25x-g524"}, "properties": {"repobilityId": "200ec4485021d767", "scanner": "scanner-primary", "fingerprint": "c1565ef968da158b", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-8xcm-r25x-g524", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cc69c4dfc89df563", "level": "warning", "message": {"text": "Vulnerable dependency undici 7.28.0: GHSA-jr45-8vmc-qm54"}, "properties": {"repobilityId": "a60d00aae56b4256", "scanner": "scanner-primary", "fingerprint": "cc69c4dfc89df563", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-jr45-8vmc-qm54", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-180c8215d6104e3e", "level": "warning", "message": {"text": "Vulnerable dependency undici 7.28.0: GHSA-m8rv-5g2x-5cg5"}, "properties": {"repobilityId": "b62c2d14132d887b", "scanner": "scanner-primary", "fingerprint": "180c8215d6104e3e", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-m8rv-5g2x-5cg5", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0ba8a10aeaabe4b4", "level": "warning", "message": {"text": "Vulnerable dependency undici 7.28.0: GHSA-v3r7-h72x-cjcm"}, "properties": {"repobilityId": "93574e8ef0a00ee0", "scanner": "scanner-primary", "fingerprint": "0ba8a10aeaabe4b4", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-v3r7-h72x-cjcm", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a2f2f8d1a34b7012", "level": "warning", "message": {"text": "Dependency commander is two or more major versions behind"}, "properties": {"repobilityId": "43b483b9f865fb7d", "scanner": "scanner-primary", "fingerprint": "a2f2f8d1a34b7012", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-93d9b19eb2da6ec2", "level": "warning", "message": {"text": "Dependency openai is two or more major versions behind"}, "properties": {"repobilityId": "c8a8ac6df6975840", "scanner": "scanner-primary", "fingerprint": "93d9b19eb2da6ec2", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d637c276d64febc3", "level": "note", "message": {"text": "Dependency zod is a major version behind"}, "properties": {"repobilityId": "6497a44c2aee361f", "scanner": "scanner-primary", "fingerprint": "d637c276d64febc3", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}]}]}