{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-3978adf1ead080a7", "name": "Possibly dead Python function: describe", "shortDescription": {"text": "Possibly dead Python function: describe"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6c09a918c0f6baae", "name": "Possibly dead Python function: probe_postgres", "shortDescription": {"text": "Possibly dead Python function: probe_postgres"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2eb0e35854d79792", "name": "Possibly dead Python function: probe_redis", "shortDescription": {"text": "Possibly dead Python function: probe_redis"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dc982114107e5433", "name": "Possibly dead Python function: probe_kafka", "shortDescription": {"text": "Possibly dead Python function: probe_kafka"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5a505e7990ca99db", "name": "Possibly dead Python function: probe_migrations", "shortDescription": {"text": "Possibly dead Python function: probe_migrations"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5cad19eb7e724739", "name": "Possibly dead Python function: add_context", "shortDescription": {"text": "Possibly dead Python function: add_context"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fff459616cf50397", "name": "Possibly dead Python function: authenticate_header", "shortDescription": {"text": "Possibly dead Python function: authenticate_header"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e2f506595a22c691", "name": "Possibly dead Python function: caller_role", "shortDescription": {"text": "Possibly dead Python function: caller_role"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6513210b5e6a9545", "name": "Possibly dead Python function: describe", "shortDescription": {"text": "Possibly dead Python function: describe"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e867099a8c10a117", "name": "Possibly dead Python function: for_active_workspace", "shortDescription": {"text": "Possibly dead Python function: for_active_workspace"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1311e000d788d175", "name": "Possibly dead Python function: all_workspaces", "shortDescription": {"text": "Possibly dead Python function: all_workspaces"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8673f78d637e6285", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/eslint.config.js:70", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/eslint.config.js:70"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-714c31ca9f474ae6", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-60427b03771411b6", "name": "Dockerfile runs as root: frontend/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: frontend/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a7f39cdd5fa21931", "name": "Docker base image is tag-pinned but not digest-pinned: node:22-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-74dcd616655bbf29", "name": "Insecure pattern 'tls_verify_false' in backend/identity/application/auth.py:66", "shortDescription": {"text": "Insecure pattern 'tls_verify_false' in backend/identity/application/auth.py:66"}, "fullDescription": {"text": "Found a known-risky pattern (tls_verify_false). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-dc71900003b7ff18", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "dorny/paths-filter@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "55 tests / 269 src (ratio 0.20)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 9 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 24 placeholder/mock markers across 20 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-274c52e1e55ca885", "name": "Commented-code block (5 lines) in backend/identity/api/serializers.py:54", "shortDescription": {"text": "Commented-code block (5 lines) in backend/identity/api/serializers.py:54"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8adcf05d5c277fbf", "name": "Commented-code block (5 lines) in backend/observation/api/problem_details.py:23", "shortDescription": {"text": "Commented-code block (5 lines) in backend/observation/api/problem_details.py:23"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-029ca7bc6b15fd6e", "name": "Commented-code block (6 lines) in backend/config/settings/test.py:33", "shortDescription": {"text": "Commented-code block (6 lines) in backend/config/settings/test.py:33"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-925d85ae58dac234", "name": "Commented-code block (5 lines) in backend/config/settings/base.py:64", "shortDescription": {"text": "Commented-code block (5 lines) in backend/config/settings/base.py:64"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-17d575617c137ba5", "name": "Commented-code block (5 lines) in backend/tenancy/application/keys.py:260", "shortDescription": {"text": "Commented-code block (5 lines) in backend/tenancy/application/keys.py:260"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cbe25be3c0ba2002", "name": "Commented-code block (5 lines) in backend/tenancy/management/commands/provision_db_roles.py:88", "shortDescription": {"text": "Commented-code block (5 lines) in backend/tenancy/management/commands/provision_db_roles.py:88"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-74f98c30de363eb5", "name": "Commented-code block (12 lines) in backend/tenancy/infra/rls.py:73", "shortDescription": {"text": "Commented-code block (12 lines) in backend/tenancy/infra/rls.py:73"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4b47c3b9a9d789f2", "name": "Commented-code block (5 lines) in backend/tenancy/infra/tenancy_exempt.py:57", "shortDescription": {"text": "Commented-code block (5 lines) in backend/tenancy/infra/tenancy_exempt.py:57"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a5977578d694ebbd", "name": "Commented-code block (6 lines) in backend/tenancy/domain/scoping.py:104", "shortDescription": {"text": "Commented-code block (6 lines) in backend/tenancy/domain/scoping.py:104"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-46969939caf8120b", "name": "Near-duplicate function bodies in 9 places", "shortDescription": {"text": "Near-duplicate function bodies in 9 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/identity/api/viewsets.py:post, backend/identity/api/viewsets.py:post, backend/identity/api/viewsets.py:post, backend/identity/api/viewsets.py:post\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/identity/application/audit.py:emit, backend/tenancy/application/audit.py:emit\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0027e313ade46c8f", "name": "Near-duplicate function bodies in 7 places", "shortDescription": {"text": "Near-duplicate function bodies in 7 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/tenancy/api/viewsets.py:get, backend/tenancy/api/viewsets.py:get, backend/tenancy/api/viewsets.py:get, backend/tenancy/api/viewsets.py:get\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/tenancy/api/viewsets.py:post, backend/tenancy/api/viewsets.py:post, backend/tenancy/api/viewsets.py:post\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/25414"}, "properties": {"repository": "dimz119/dataforge", "repoUrl": "https://github.com/dimz119/dataforge", "branch": "main"}, "results": [{"ruleId": "scanner-3978adf1ead080a7", "level": "note", "message": {"text": "Possibly dead Python function: describe"}, "properties": {"repobilityId": "031a29a46186597a", "scanner": "scanner-primary", "fingerprint": "3978adf1ead080a7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/audit/infra/rls.py:98"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6c09a918c0f6baae", "level": "note", "message": {"text": "Possibly dead Python function: probe_postgres"}, "properties": {"repobilityId": "9efd1dfb64119dfc", "scanner": "scanner-primary", "fingerprint": "6c09a918c0f6baae", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/observation/infra/probes.py:15"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2eb0e35854d79792", "level": "note", "message": {"text": "Possibly dead Python function: probe_redis"}, "properties": {"repobilityId": "14d8f63b30f78e51", "scanner": "scanner-primary", "fingerprint": "2eb0e35854d79792", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/observation/infra/probes.py:22"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dc982114107e5433", "level": "note", "message": {"text": "Possibly dead Python function: probe_kafka"}, "properties": {"repobilityId": "8746f8ebd7bac27c", "scanner": "scanner-primary", "fingerprint": "dc982114107e5433", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/observation/infra/probes.py:33"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5a505e7990ca99db", "level": "note", "message": {"text": "Possibly dead Python function: probe_migrations"}, "properties": {"repobilityId": "3583e39412cde0b1", "scanner": "scanner-primary", "fingerprint": "5a505e7990ca99db", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/observation/infra/probes.py:39"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5cad19eb7e724739", "level": "note", "message": {"text": "Possibly dead Python function: add_context"}, "properties": {"repobilityId": "ad5be8ebc9611022", "scanner": "scanner-primary", "fingerprint": "5cad19eb7e724739", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/config/logging.py:96"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fff459616cf50397", "level": "note", "message": {"text": "Possibly dead Python function: authenticate_header"}, "properties": {"repobilityId": "ee7351f4b3967891", "scanner": "scanner-primary", "fingerprint": "fff459616cf50397", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/tenancy/api/authentication.py:80"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e2f506595a22c691", "level": "note", "message": {"text": "Possibly dead Python function: caller_role"}, "properties": {"repobilityId": "1e306302ced0bb42", "scanner": "scanner-primary", "fingerprint": "e2f506595a22c691", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/tenancy/application/keys.py:319"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6513210b5e6a9545", "level": "note", "message": {"text": "Possibly dead Python function: describe"}, "properties": {"repobilityId": "031a29a46186597a", "scanner": "scanner-primary", "fingerprint": "6513210b5e6a9545", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/tenancy/infra/rls.py:159"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e867099a8c10a117", "level": "note", "message": {"text": "Possibly dead Python function: for_active_workspace"}, "properties": {"repobilityId": "fe06942647c736b2", "scanner": "scanner-primary", "fingerprint": "e867099a8c10a117", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/tenancy/domain/scoping.py:33"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1311e000d788d175", "level": "note", "message": {"text": "Possibly dead Python function: all_workspaces"}, "properties": {"repobilityId": "0b48e054aab57829", "scanner": "scanner-primary", "fingerprint": "1311e000d788d175", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/tenancy/domain/scoping.py:57"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8673f78d637e6285", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/eslint.config.js:70"}, "properties": {"repobilityId": "5b50d20f7f774fa6", "scanner": "scanner-primary", "fingerprint": "8673f78d637e6285", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-714c31ca9f474ae6", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim"}, "properties": {"repobilityId": "5012d43735c30c38", "scanner": "scanner-primary", "fingerprint": "714c31ca9f474ae6", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/Dockerfile"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-60427b03771411b6", "level": "warning", "message": {"text": "Dockerfile runs as root: frontend/Dockerfile"}, "properties": {"repobilityId": "735c01d8531dfd2c", "scanner": "scanner-primary", "fingerprint": "60427b03771411b6", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-a7f39cdd5fa21931", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-alpine"}, "properties": {"repobilityId": "ca625bdf4115d362", "scanner": "scanner-primary", "fingerprint": "a7f39cdd5fa21931", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/Dockerfile"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-74dcd616655bbf29", "level": "error", "message": {"text": "Insecure pattern 'tls_verify_false' in backend/identity/application/auth.py:66"}, "properties": {"repobilityId": "b51e0eb8257bf216", "scanner": "scanner-primary", "fingerprint": "74dcd616655bbf29", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "tls_verify_false"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/identity/application/auth.py"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-dc71900003b7ff18", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "508fe373bc2853b7", "scanner": "scanner-primary", "fingerprint": "dc71900003b7ff18", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yaml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "1b4ef4916bda45f5", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "388c42de63f38410", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "58495c20fd142433", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-274c52e1e55ca885", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/identity/api/serializers.py:54"}, "properties": {"repobilityId": "339d8d5ac80ec813", "scanner": "scanner-primary", "fingerprint": "274c52e1e55ca885", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8adcf05d5c277fbf", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/observation/api/problem_details.py:23"}, "properties": {"repobilityId": "d1c14169724bf14b", "scanner": "scanner-primary", "fingerprint": "8adcf05d5c277fbf", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-029ca7bc6b15fd6e", "level": "none", "message": {"text": "Commented-code block (6 lines) in backend/config/settings/test.py:33"}, "properties": {"repobilityId": "1d003312ed12a83f", "scanner": "scanner-primary", "fingerprint": "029ca7bc6b15fd6e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-925d85ae58dac234", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/config/settings/base.py:64"}, "properties": {"repobilityId": "55654fb641d05f59", "scanner": "scanner-primary", "fingerprint": "925d85ae58dac234", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-17d575617c137ba5", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/tenancy/application/keys.py:260"}, "properties": {"repobilityId": "8da86af3571fdebf", "scanner": "scanner-primary", "fingerprint": "17d575617c137ba5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cbe25be3c0ba2002", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/tenancy/management/commands/provision_db_roles.py:88"}, "properties": {"repobilityId": "b84bd0be12de9866", "scanner": "scanner-primary", "fingerprint": "cbe25be3c0ba2002", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-74f98c30de363eb5", "level": "none", "message": {"text": "Commented-code block (12 lines) in backend/tenancy/infra/rls.py:73"}, "properties": {"repobilityId": "7ab102d4597bfce2", "scanner": "scanner-primary", "fingerprint": "74f98c30de363eb5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4b47c3b9a9d789f2", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/tenancy/infra/tenancy_exempt.py:57"}, "properties": {"repobilityId": "4f17f1665ba5c9c4", "scanner": "scanner-primary", "fingerprint": "4b47c3b9a9d789f2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a5977578d694ebbd", "level": "none", "message": {"text": "Commented-code block (6 lines) in backend/tenancy/domain/scoping.py:104"}, "properties": {"repobilityId": "faa8a793a770ba68", "scanner": "scanner-primary", "fingerprint": "a5977578d694ebbd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-46969939caf8120b", "level": "note", "message": {"text": "Near-duplicate function bodies in 9 places"}, "properties": {"repobilityId": "ceaab0b036f4d267", "scanner": "scanner-primary", "fingerprint": "46969939caf8120b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "b35394c7a94b6e7d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "4d1d5fcac033ad22", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-0027e313ade46c8f", "level": "note", "message": {"text": "Near-duplicate function bodies in 7 places"}, "properties": {"repobilityId": "622c15bc88a76a0e", "scanner": "scanner-primary", "fingerprint": "0027e313ade46c8f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "d8f7c97bfef919e0", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "9e8cf1e42fa6eefb", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "f5d3eecb7f10be6b", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "3ae89ba756c4aa8e", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "03c351972656ef8b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "a6e812bafabc0efb", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "64372b02d9388172", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}