{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-84cb733aec538a7c", "name": "Possibly dead Python function: weight_poller", "shortDescription": {"text": "Possibly dead Python function: weight_poller"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-45ffaed381532f75", "name": "Possibly dead Python function: rate_printer", "shortDescription": {"text": "Possibly dead Python function: rate_printer"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0a006a03e8d954ee", "name": "Possibly dead Python function: feedback_listener", "shortDescription": {"text": "Possibly dead Python function: feedback_listener"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-483a8a7e4f68900e", "name": "Possibly dead Python function: print_snark_pseudo_queue", "shortDescription": {"text": "Possibly dead Python function: print_snark_pseudo_queue"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-03c18ff0d0862021", "name": "Possibly dead Python function: p95", "shortDescription": {"text": "Possibly dead Python function: p95"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a1b1025f5e1514f5", "name": "Stray `console.log` in TS/JS \u2014 SNARKVerifierWorker.js:82", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 SNARKVerifierWorker.js:82"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "2 tests / 17 src (ratio 0.12)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 155 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e9ba2b43734a51fb", "name": "Commented-code block (7 lines) in verifierSelector.py:14", "shortDescription": {"text": "Commented-code block (7 lines) in verifierSelector.py:14"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-173c9028fdcd12ba", "name": "Network/subprocess call without timeout or try/except \u2014 weight_sweep.py:110", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 weight_sweep.py:110"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0efb4795ca4ae4d2", "name": "Network/subprocess call without timeout or try/except \u2014 sweep_throughput.py:112", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 sweep_throughput.py:112"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0e3f9e304ff61a2b", "name": "Commented-code block (6 lines) in TokenIssuanceModule.py:14", "shortDescription": {"text": "Commented-code block (6 lines) in TokenIssuanceModule.py:14"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9b1f33f86044cda3", "name": "Network/subprocess call without timeout or try/except \u2014 TokenIssuanceModule.py:21", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 TokenIssuanceModule.py:21"}, "fullDescription": {"text": "`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-65c77c64faef4884", "name": "Commented-code block (6 lines) in load_test.js:5", "shortDescription": {"text": "Commented-code block (6 lines) in load_test.js:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-36d5e4188acf0bc5", "name": "Commented-code block (6 lines) in load_test_onprem.js:5", "shortDescription": {"text": "Commented-code block (6 lines) in load_test_onprem.js:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fb95b2771051e8aa", "name": "Commented-code block (6 lines) in SNARKVerifierWorker.js:13", "shortDescription": {"text": "Commented-code block (6 lines) in SNARKVerifierWorker.js:13"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-806b7f4aadde7121", "name": "FastAPI POST `ingest` without auth dependency \u2014 TokenValidatorService.py:147", "shortDescription": {"text": "FastAPI POST `ingest` without auth dependency \u2014 TokenValidatorService.py:147"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f768339e90914bc8", "name": "FastAPI POST `submit_request` without auth dependency \u2014 requestHandler.py:22", "shortDescription": {"text": "FastAPI POST `submit_request` without auth dependency \u2014 requestHandler.py:22"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-78407ab90a5a469f", "name": "FastAPI POST `set_weight` without auth dependency \u2014 requestHandler.py:110", "shortDescription": {"text": "FastAPI POST `set_weight` without auth dependency \u2014 requestHandler.py:110"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/27332"}, "properties": {"repository": "lANXEZ/ZK-AuthaaS-Simulation", "repoUrl": "https://github.com/lANXEZ/ZK-AuthaaS-Simulation", "branch": "main"}, "results": [{"ruleId": "scanner-84cb733aec538a7c", "level": "note", "message": {"text": "Possibly dead Python function: weight_poller"}, "properties": {"repobilityId": "28d6e3b8e1d59f8f", "scanner": "scanner-primary", "fingerprint": "84cb733aec538a7c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "verifierSelector.py:100"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-45ffaed381532f75", "level": "note", "message": {"text": "Possibly dead Python function: rate_printer"}, "properties": {"repobilityId": "459df9da983a1bc8", "scanner": "scanner-primary", "fingerprint": "45ffaed381532f75", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "verifierSelector.py:140"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0a006a03e8d954ee", "level": "note", "message": {"text": "Possibly dead Python function: feedback_listener"}, "properties": {"repobilityId": "294b466fae13577b", "scanner": "scanner-primary", "fingerprint": "0a006a03e8d954ee", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "verifierSelector.py:154"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-483a8a7e4f68900e", "level": "note", "message": {"text": "Possibly dead Python function: print_snark_pseudo_queue"}, "properties": {"repobilityId": "9a1d0bd9907de7ba", "scanner": "scanner-primary", "fingerprint": "483a8a7e4f68900e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "verifierSelector.py:178"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-03c18ff0d0862021", "level": "note", "message": {"text": "Possibly dead Python function: p95"}, "properties": {"repobilityId": "88e44be822b8fc45", "scanner": "scanner-primary", "fingerprint": "03c18ff0d0862021", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "visualize_k6.py:34"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a1b1025f5e1514f5", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 SNARKVerifierWorker.js:82"}, "properties": {"repobilityId": "1fcabddcd2551dd9", "scanner": "scanner-primary", "fingerprint": "a1b1025f5e1514f5", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "7a461b14c8b0ba12", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "6156c08795140d4c", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "3c2cc020c41e31ae", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-e9ba2b43734a51fb", "level": "none", "message": {"text": "Commented-code block (7 lines) in verifierSelector.py:14"}, "properties": {"repobilityId": "49a3c605361b0e63", "scanner": "scanner-primary", "fingerprint": "e9ba2b43734a51fb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-173c9028fdcd12ba", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 weight_sweep.py:110"}, "properties": {"repobilityId": "6886dc79799e85e1", "scanner": "scanner-primary", "fingerprint": "173c9028fdcd12ba", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-0efb4795ca4ae4d2", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 sweep_throughput.py:112"}, "properties": {"repobilityId": "a861abaebdd4faad", "scanner": "scanner-primary", "fingerprint": "0efb4795ca4ae4d2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-0e3f9e304ff61a2b", "level": "none", "message": {"text": "Commented-code block (6 lines) in TokenIssuanceModule.py:14"}, "properties": {"repobilityId": "bee62be68b5d1536", "scanner": "scanner-primary", "fingerprint": "0e3f9e304ff61a2b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9b1f33f86044cda3", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 TokenIssuanceModule.py:21"}, "properties": {"repobilityId": "ea5943e2ae478ade", "scanner": "scanner-primary", "fingerprint": "9b1f33f86044cda3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-65c77c64faef4884", "level": "none", "message": {"text": "Commented-code block (6 lines) in load_test.js:5"}, "properties": {"repobilityId": "a2b2013a95514836", "scanner": "scanner-primary", "fingerprint": "65c77c64faef4884", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-36d5e4188acf0bc5", "level": "none", "message": {"text": "Commented-code block (6 lines) in load_test_onprem.js:5"}, "properties": {"repobilityId": "f4711ff90a8e0b3f", "scanner": "scanner-primary", "fingerprint": "36d5e4188acf0bc5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fb95b2771051e8aa", "level": "none", "message": {"text": "Commented-code block (6 lines) in SNARKVerifierWorker.js:13"}, "properties": {"repobilityId": "331b099a1384b4fa", "scanner": "scanner-primary", "fingerprint": "fb95b2771051e8aa", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-806b7f4aadde7121", "level": "error", "message": {"text": "FastAPI POST `ingest` without auth dependency \u2014 TokenValidatorService.py:147"}, "properties": {"repobilityId": "ff7d8952d8006c36", "scanner": "scanner-primary", "fingerprint": "806b7f4aadde7121", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "TokenValidatorService.py"}, "region": {"startLine": 147}}}]}, {"ruleId": "scanner-f768339e90914bc8", "level": "error", "message": {"text": "FastAPI POST `submit_request` without auth dependency \u2014 requestHandler.py:22"}, "properties": {"repobilityId": "fec484e16b167c3c", "scanner": "scanner-primary", "fingerprint": "f768339e90914bc8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "requestHandler.py"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-78407ab90a5a469f", "level": "error", "message": {"text": "FastAPI POST `set_weight` without auth dependency \u2014 requestHandler.py:110"}, "properties": {"repobilityId": "d857a5cf7e081f96", "scanner": "scanner-primary", "fingerprint": "78407ab90a5a469f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "requestHandler.py"}, "region": {"startLine": 110}}}]}]}]}