{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-fe53f949ab774222", "name": "Stray `console.log` in TS/JS \u2014 scripts/send-push.js:98", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/send-push.js:98"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-032a7a5c7c0e146d", "name": "Insecure pattern 'direct_innerhtml_assignment' in index.html:500", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in index.html:500"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ce196838089cbc3a", "name": "Insecure pattern 'direct_innerhtml_assignment' in schedule/index.html:348", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in schedule/index.html:348"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3a9edb1b888e9b04", "name": "Insecure pattern 'direct_innerhtml_assignment' in adventure/index.html:420", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in adventure/index.html:420"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3d450d54329b8f67", "name": "Insecure pattern 'direct_innerhtml_assignment' in events/index.html:205", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in events/index.html:205"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1eb81e8c659777cf", "name": "Insecure pattern 'direct_innerhtml_assignment' in staff/scan.html:314", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in staff/scan.html:314"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cb16ccda42de0a13", "name": "Insecure pattern 'direct_innerhtml_assignment' in dao/index.html:3507", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in dao/index.html:3507"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d543bd8c7aded7f7", "name": "Insecure pattern 'insert_adjacent_html' in dao/index.html:3457", "shortDescription": {"text": "Insecure pattern 'insert_adjacent_html' in dao/index.html:3457"}, "fullDescription": {"text": "Found a known-risky pattern (insert_adjacent_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-36c89f766755d4d3", "name": "Insecure pattern 'direct_innerhtml_assignment' in dao/checkin.html:247", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in dao/checkin.html:247"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-83287307678456f2", "name": "Insecure pattern 'direct_innerhtml_assignment' in dao/minutes.html:171", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in dao/minutes.html:171"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d5d839a13a8372c4", "name": "Insecure pattern 'direct_innerhtml_assignment' in member-app/html.html:1388", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in member-app/html.html:1388"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-275868cbd2db575b", "name": "Insecure pattern 'node_child_process' in scripts/send-push.js:18", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/send-push.js:18"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-165dd93c2e1b68cd", "name": "Insecure pattern 'direct_innerhtml_assignment' in gas/image-scan.gs.js:1599", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in gas/image-scan.gs.js:1599"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-386e01021124ac28", "name": "Insecure pattern 'direct_innerhtml_assignment' in gas/image-upload.html:239", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in gas/image-upload.html:239"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-08f2b1716a527462", "name": "Possible secret in gas/dao-points.js", "shortDescription": {"text": "Possible secret in gas/dao-points.js"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-72f27471e4bc5d86", "name": "Insecure pattern 'direct_innerhtml_assignment' in gas/\u30b3\u30fc\u30c9.js:1771", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in gas/\u30b3\u30fc\u30c9.js:1771"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-53d19f6376f74422", "name": "Insecure pattern 'direct_innerhtml_assignment' in gas/dao-proposals.html:720", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in gas/dao-proposals.html:720"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d5b845350f4a1b83", "name": "Insecure pattern 'direct_innerhtml_assignment' in bunkazai-map/index.html:379", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in bunkazai-map/index.html:379"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a24f38c98e499e5b", "name": "Possible secret in admin/index.html", "shortDescription": {"text": "Possible secret in admin/index.html"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-9e67093350ed77da", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin/index.html:304", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/index.html:304"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4a52b0acc1f6efba", "name": "Possible secret in admin/campaigns.html", "shortDescription": {"text": "Possible secret in admin/campaigns.html"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-83b5435ce6e42672", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin/campaigns.html:251", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/campaigns.html:251"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-164f4f65796da893", "name": "Insecure pattern 'document_write' in lab/cidao-roadmap.html:16", "shortDescription": {"text": "Insecure pattern 'document_write' in lab/cidao-roadmap.html:16"}, "fullDescription": {"text": "Found a known-risky pattern (document_write). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4734ccb8dd229749", "name": "Insecure pattern 'direct_innerhtml_assignment' in lab/cidao-roadmap.html:632", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in lab/cidao-roadmap.html:632"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8381a770a38db18d", "name": "Insecure pattern 'local_storage_auth_token' in lab/cidao-roadmap.html:30", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in lab/cidao-roadmap.html:30"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-123e1174ec1faefb", "name": "Insecure pattern 'direct_innerhtml_assignment' in lab/index.html:590", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in lab/index.html:590"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fda12497ce37aeda", "name": "Insecure pattern 'local_storage_auth_token' in lab/index.html:407", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in lab/index.html:407"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-185fe25a61c66b91", "name": "Insecure pattern 'direct_innerhtml_assignment' in organizations/index.html:280", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in organizations/index.html:280"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2f7bbf606ddb04f8", "name": "Insecure pattern 'direct_innerhtml_assignment' in dangotsusin/index.html:366", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in dangotsusin/index.html:366"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-65055ca66f685322", "name": "Possible secret in metaverse/index.html", "shortDescription": {"text": "Possible secret in metaverse/index.html"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-aa855240332327ba", "name": "Insecure pattern 'direct_innerhtml_assignment' in metaverse/index.html:518", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in metaverse/index.html:518"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d08cd6626a20d9b8", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46d0af191538742c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a1d5ccda1dd92be5", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8311344cc8b47659", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-16ae2520e9cd24eb", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a352d1725eaa887d", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-638ae0a41a057127", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-647abbcb2d2c389c", "name": "Very large file: gas/image-scan.gs.js (3183 lines)", "shortDescription": {"text": "Very large file: gas/image-scan.gs.js (3183 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e3c00b2fed8ae541", "name": "Very large file: gas/dao-points.js (3486 lines)", "shortDescription": {"text": "Very large file: gas/dao-points.js (3486 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e617900bf31449c2", "name": "Very large file: gas/\u30b3\u30fc\u30c9.js (3699 lines)", "shortDescription": {"text": "Very large file: gas/\u30b3\u30fc\u30c9.js (3699 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-246da298cd1c9282", "name": "Very large file: assets/jsqr.min.js (10101 lines)", "shortDescription": {"text": "Very large file: assets/jsqr.min.js (10101 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4afe90e600cb9b42", "name": "Very large file: assets/qrcode-generator.js (2297 lines)", "shortDescription": {"text": "Very large file: assets/qrcode-generator.js (2297 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 16 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-01f96f71d9907a8c", "name": "README lacks setup or run instructions", "shortDescription": {"text": "README lacks setup or run instructions"}, "fullDescription": {"text": "A README exists, but it does not contain common install/setup/run markers. This matches a frequent generated-code pattern: UI is present, operational handoff is thin."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 16 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, tests, operator-readme. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b364ea26f8adc889", "name": "Legacy-named symbol `TOPICS_\u8aa4\u6df7\u5165_backup` in gas/event-topics-normalized-submit.gs.js:72", "shortDescription": {"text": "Legacy-named symbol `TOPICS_\u8aa4\u6df7\u5165_backup` in gas/event-topics-normalized-submit.gs.js:72"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-698f5629b8bd9dfe", "name": "Commented-code block (5 lines) in gas/image-scan.gs.js:365", "shortDescription": {"text": "Commented-code block (5 lines) in gas/image-scan.gs.js:365"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bcfabbc12cd278bb", "name": "`fetch()` without try/.catch or AbortSignal \u2014 gas/image-scan.gs.js:1790", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 gas/image-scan.gs.js:1790"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8ee9fb4e2f66649f", "name": "`fetch()` without try/.catch or AbortSignal \u2014 gas/dao-points.js:430", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 gas/dao-points.js:430"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d19964bba36763e6", "name": "Commented-code block (5 lines) in gas/\u30b3\u30fc\u30c9.js:398", "shortDescription": {"text": "Commented-code block (5 lines) in gas/\u30b3\u30fc\u30c9.js:398"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-958b490657f084bd", "name": "`fetch()` without try/.catch or AbortSignal \u2014 gas/\u30b3\u30fc\u30c9.js:1962", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 gas/\u30b3\u30fc\u30c9.js:1962"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5b8a790f3a0dcb73", "name": "Commented-code block (6 lines) in assets/jsqr.min.js:449", "shortDescription": {"text": "Commented-code block (6 lines) in assets/jsqr.min.js:449"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23327"}, "properties": {"repository": "you0810jmsdf/cocola-site", "repoUrl": "https://github.com/you0810jmsdf/cocola-site", "branch": "main"}, "results": [{"ruleId": "scanner-fe53f949ab774222", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/send-push.js:98"}, "properties": {"repobilityId": "0e58184ba8389337", "scanner": "scanner-primary", "fingerprint": "fe53f949ab774222", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-032a7a5c7c0e146d", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in index.html:500"}, "properties": {"repobilityId": "f91708437a3a5445", "scanner": "scanner-primary", "fingerprint": "032a7a5c7c0e146d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "index.html"}, "region": {"startLine": 500}}}]}, {"ruleId": "scanner-ce196838089cbc3a", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in schedule/index.html:348"}, "properties": {"repobilityId": "41aa9380c652f139", "scanner": "scanner-primary", "fingerprint": "ce196838089cbc3a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "schedule/index.html"}, "region": {"startLine": 348}}}]}, {"ruleId": "scanner-3a9edb1b888e9b04", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in adventure/index.html:420"}, "properties": {"repobilityId": "6a2cc33381998e8e", "scanner": "scanner-primary", "fingerprint": "3a9edb1b888e9b04", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "adventure/index.html"}, "region": {"startLine": 420}}}]}, {"ruleId": "scanner-3d450d54329b8f67", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in events/index.html:205"}, "properties": {"repobilityId": "d337fddfbf14cef3", "scanner": "scanner-primary", "fingerprint": "3d450d54329b8f67", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "events/index.html"}, "region": {"startLine": 205}}}]}, {"ruleId": "scanner-1eb81e8c659777cf", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in staff/scan.html:314"}, "properties": {"repobilityId": "2290c29fc9e4550e", "scanner": "scanner-primary", "fingerprint": "1eb81e8c659777cf", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "staff/scan.html"}, "region": {"startLine": 314}}}]}, {"ruleId": "scanner-cb16ccda42de0a13", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in dao/index.html:3507"}, "properties": {"repobilityId": "53cabef2b865462f", "scanner": "scanner-primary", "fingerprint": "cb16ccda42de0a13", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dao/index.html"}, "region": {"startLine": 3507}}}]}, {"ruleId": "scanner-d543bd8c7aded7f7", "level": "warning", "message": {"text": "Insecure pattern 'insert_adjacent_html' in dao/index.html:3457"}, "properties": {"repobilityId": "28b5736143813c6f", "scanner": "scanner-primary", "fingerprint": "d543bd8c7aded7f7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "insert_adjacent_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dao/index.html"}, "region": {"startLine": 3457}}}]}, {"ruleId": "scanner-36c89f766755d4d3", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in dao/checkin.html:247"}, "properties": {"repobilityId": "6a65f9a17420b6c9", "scanner": "scanner-primary", "fingerprint": "36c89f766755d4d3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dao/checkin.html"}, "region": {"startLine": 247}}}]}, {"ruleId": "scanner-83287307678456f2", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in dao/minutes.html:171"}, "properties": {"repobilityId": "17f5bf8148e8bcec", "scanner": "scanner-primary", "fingerprint": "83287307678456f2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dao/minutes.html"}, "region": {"startLine": 171}}}]}, {"ruleId": "scanner-d5d839a13a8372c4", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in member-app/html.html:1388"}, "properties": {"repobilityId": "78f4deae7b714c5c", "scanner": "scanner-primary", "fingerprint": "d5d839a13a8372c4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "member-app/html.html"}, "region": {"startLine": 1388}}}]}, {"ruleId": "scanner-275868cbd2db575b", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/send-push.js:18"}, "properties": {"repobilityId": "afc2779685767059", "scanner": "scanner-primary", "fingerprint": "275868cbd2db575b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/send-push.js"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-165dd93c2e1b68cd", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in gas/image-scan.gs.js:1599"}, "properties": {"repobilityId": "8137e5365ea9194e", "scanner": "scanner-primary", "fingerprint": "165dd93c2e1b68cd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "gas/image-scan.gs.js"}, "region": {"startLine": 1599}}}]}, {"ruleId": "scanner-386e01021124ac28", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in gas/image-upload.html:239"}, "properties": {"repobilityId": "05db9aac39ad3eb7", "scanner": "scanner-primary", "fingerprint": "386e01021124ac28", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "gas/image-upload.html"}, "region": {"startLine": 239}}}]}, {"ruleId": "scanner-08f2b1716a527462", "level": "error", "message": {"text": "Possible secret in gas/dao-points.js"}, "properties": {"repobilityId": "4debfeeaa85b4354", "scanner": "scanner-primary", "fingerprint": "08f2b1716a527462", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "gas/dao-points.js"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-72f27471e4bc5d86", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in gas/\u30b3\u30fc\u30c9.js:1771"}, "properties": {"repobilityId": "c4c0942c5dc23453", "scanner": "scanner-primary", "fingerprint": "72f27471e4bc5d86", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "gas/\u30b3\u30fc\u30c9.js"}, "region": {"startLine": 1771}}}]}, {"ruleId": "scanner-53d19f6376f74422", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in gas/dao-proposals.html:720"}, "properties": {"repobilityId": "489cf8caaaa77fea", "scanner": "scanner-primary", "fingerprint": "53d19f6376f74422", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "gas/dao-proposals.html"}, "region": {"startLine": 720}}}]}, {"ruleId": "scanner-d5b845350f4a1b83", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in bunkazai-map/index.html:379"}, "properties": {"repobilityId": "ad8b567b6a216ae6", "scanner": "scanner-primary", "fingerprint": "d5b845350f4a1b83", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "bunkazai-map/index.html"}, "region": {"startLine": 379}}}]}, {"ruleId": "scanner-a24f38c98e499e5b", "level": "error", "message": {"text": "Possible secret in admin/index.html"}, "properties": {"repobilityId": "e4a7676c8f19d239", "scanner": "scanner-primary", "fingerprint": "a24f38c98e499e5b", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/index.html"}, "region": {"startLine": 213}}}]}, {"ruleId": "scanner-9e67093350ed77da", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/index.html:304"}, "properties": {"repobilityId": "d75ddf931ed139f4", "scanner": "scanner-primary", "fingerprint": "9e67093350ed77da", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/index.html"}, "region": {"startLine": 304}}}]}, {"ruleId": "scanner-4a52b0acc1f6efba", "level": "error", "message": {"text": "Possible secret in admin/campaigns.html"}, "properties": {"repobilityId": "1bffb4365072a4f6", "scanner": "scanner-primary", "fingerprint": "4a52b0acc1f6efba", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/campaigns.html"}, "region": {"startLine": 168}}}]}, {"ruleId": "scanner-83b5435ce6e42672", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/campaigns.html:251"}, "properties": {"repobilityId": "1cfcb27f654b968d", "scanner": "scanner-primary", "fingerprint": "83b5435ce6e42672", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/campaigns.html"}, "region": {"startLine": 251}}}]}, {"ruleId": "scanner-164f4f65796da893", "level": "note", "message": {"text": "Insecure pattern 'document_write' in lab/cidao-roadmap.html:16"}, "properties": {"repobilityId": "4ac07303203e54d4", "scanner": "scanner-primary", "fingerprint": "164f4f65796da893", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "document_write"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lab/cidao-roadmap.html"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-4734ccb8dd229749", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in lab/cidao-roadmap.html:632"}, "properties": {"repobilityId": "302099067d1a0bc5", "scanner": "scanner-primary", "fingerprint": "4734ccb8dd229749", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lab/cidao-roadmap.html"}, "region": {"startLine": 632}}}]}, {"ruleId": "scanner-8381a770a38db18d", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in lab/cidao-roadmap.html:30"}, "properties": {"repobilityId": "33fe6bba50249a31", "scanner": "scanner-primary", "fingerprint": "8381a770a38db18d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lab/cidao-roadmap.html"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-123e1174ec1faefb", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in lab/index.html:590"}, "properties": {"repobilityId": "9a335f8acb91dceb", "scanner": "scanner-primary", "fingerprint": "123e1174ec1faefb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lab/index.html"}, "region": {"startLine": 590}}}]}, {"ruleId": "scanner-fda12497ce37aeda", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in lab/index.html:407"}, "properties": {"repobilityId": "68ab49af7ab6d67a", "scanner": "scanner-primary", "fingerprint": "fda12497ce37aeda", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lab/index.html"}, "region": {"startLine": 407}}}]}, {"ruleId": "scanner-185fe25a61c66b91", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in organizations/index.html:280"}, "properties": {"repobilityId": "f06c281c3976d2bf", "scanner": "scanner-primary", "fingerprint": "185fe25a61c66b91", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "organizations/index.html"}, "region": {"startLine": 280}}}]}, {"ruleId": "scanner-2f7bbf606ddb04f8", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in dangotsusin/index.html:366"}, "properties": {"repobilityId": "60cc7500a52e1b2d", "scanner": "scanner-primary", "fingerprint": "2f7bbf606ddb04f8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dangotsusin/index.html"}, "region": {"startLine": 366}}}]}, {"ruleId": "scanner-65055ca66f685322", "level": "error", "message": {"text": "Possible secret in metaverse/index.html"}, "properties": {"repobilityId": "7de3e1f2fbd95296", "scanner": "scanner-primary", "fingerprint": "65055ca66f685322", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "metaverse/index.html"}, "region": {"startLine": 428}}}]}, {"ruleId": "scanner-aa855240332327ba", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in metaverse/index.html:518"}, "properties": {"repobilityId": "54e5a8dc34c78cf9", "scanner": "scanner-primary", "fingerprint": "aa855240332327ba", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "metaverse/index.html"}, "region": {"startLine": 518}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-d08cd6626a20d9b8", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "f56b4246c191fc46", "scanner": "scanner-primary", "fingerprint": "d08cd6626a20d9b8", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/update-schedule-data.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-46d0af191538742c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "2b58b33e9041e921", "scanner": "scanner-primary", "fingerprint": "46d0af191538742c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/update-events-data.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a1d5ccda1dd92be5", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "40c702e13222efcf", "scanner": "scanner-primary", "fingerprint": "a1d5ccda1dd92be5", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/sync-event-sources.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8311344cc8b47659", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b44350113a40d66d", "scanner": "scanner-primary", "fingerprint": "8311344cc8b47659", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/update-members-data.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-16ae2520e9cd24eb", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "3ad6866ecfb5444c", "scanner": "scanner-primary", "fingerprint": "16ae2520e9cd24eb", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/update-dao-data.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a352d1725eaa887d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ca71647792a5644c", "scanner": "scanner-primary", "fingerprint": "a352d1725eaa887d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/push-notify.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-a352d1725eaa887d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a033ecb3296c2d8c", "scanner": "scanner-primary", "fingerprint": "a352d1725eaa887d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/push-notify.yml"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-638ae0a41a057127", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "0bc9b56139ecffa2", "scanner": "scanner-primary", "fingerprint": "638ae0a41a057127", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/update-dangotsusin-data.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-647abbcb2d2c389c", "level": "note", "message": {"text": "Very large file: gas/image-scan.gs.js (3183 lines)"}, "properties": {"repobilityId": "a7249d0f1433357e", "scanner": "scanner-primary", "fingerprint": "647abbcb2d2c389c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e3c00b2fed8ae541", "level": "note", "message": {"text": "Very large file: gas/dao-points.js (3486 lines)"}, "properties": {"repobilityId": "43a395d78cca3804", "scanner": "scanner-primary", "fingerprint": "e3c00b2fed8ae541", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e617900bf31449c2", "level": "note", "message": {"text": "Very large file: gas/\u30b3\u30fc\u30c9.js (3699 lines)"}, "properties": {"repobilityId": "19f915a6341052f8", "scanner": "scanner-primary", "fingerprint": "e617900bf31449c2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-246da298cd1c9282", "level": "note", "message": {"text": "Very large file: assets/jsqr.min.js (10101 lines)"}, "properties": {"repobilityId": "2254077215f8bd59", "scanner": "scanner-primary", "fingerprint": "246da298cd1c9282", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4afe90e600cb9b42", "level": "note", "message": {"text": "Very large file: assets/qrcode-generator.js (2297 lines)"}, "properties": {"repobilityId": "0f4b76a55f7785d2", "scanner": "scanner-primary", "fingerprint": "4afe90e600cb9b42", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "1e644ac25a9e6765", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-01f96f71d9907a8c", "level": "note", "message": {"text": "README lacks setup or run instructions"}, "properties": {"repobilityId": "9ba9abc35082728a", "scanner": "scanner-primary", "fingerprint": "01f96f71d9907a8c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["docs", "readme", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "d211b76e3bdb584d", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "3c3b0d348bc591c8", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "046ae414c8661501", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "e913d3957f723784", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "96c1edbf5e45b345", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "dc43ca565b5b0b09", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-b364ea26f8adc889", "level": "note", "message": {"text": "Legacy-named symbol `TOPICS_\u8aa4\u6df7\u5165_backup` in gas/event-topics-normalized-submit.gs.js:72"}, "properties": {"repobilityId": "ef4dc30ac497ed53", "scanner": "scanner-primary", "fingerprint": "b364ea26f8adc889", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-698f5629b8bd9dfe", "level": "none", "message": {"text": "Commented-code block (5 lines) in gas/image-scan.gs.js:365"}, "properties": {"repobilityId": "b30b2900c3def8b0", "scanner": "scanner-primary", "fingerprint": "698f5629b8bd9dfe", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bcfabbc12cd278bb", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 gas/image-scan.gs.js:1790"}, "properties": {"repobilityId": "4f33c7c673c09a93", "scanner": "scanner-primary", "fingerprint": "bcfabbc12cd278bb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-8ee9fb4e2f66649f", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 gas/dao-points.js:430"}, "properties": {"repobilityId": "7d842037a2a566a9", "scanner": "scanner-primary", "fingerprint": "8ee9fb4e2f66649f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-d19964bba36763e6", "level": "none", "message": {"text": "Commented-code block (5 lines) in gas/\u30b3\u30fc\u30c9.js:398"}, "properties": {"repobilityId": "711f144ca035c70c", "scanner": "scanner-primary", "fingerprint": "d19964bba36763e6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-958b490657f084bd", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 gas/\u30b3\u30fc\u30c9.js:1962"}, "properties": {"repobilityId": "3e806c342b636818", "scanner": "scanner-primary", "fingerprint": "958b490657f084bd", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-5b8a790f3a0dcb73", "level": "none", "message": {"text": "Commented-code block (6 lines) in assets/jsqr.min.js:449"}, "properties": {"repobilityId": "adb1a2ca8f33392c", "scanner": "scanner-primary", "fingerprint": "5b8a790f3a0dcb73", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}