{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-6aa9a4dc34dbf30d", "name": "Possibly dead Python function: cmd_prepare", "shortDescription": {"text": "Possibly dead Python function: cmd_prepare"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6544b6050f193b1d", "name": "Possibly dead Python function: cmd_extract", "shortDescription": {"text": "Possibly dead Python function: cmd_extract"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4c32693868b4d942", "name": "Possibly dead Python function: cmd_sync_latest_json", "shortDescription": {"text": "Possibly dead Python function: cmd_sync_latest_json"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9701e724dca54920", "name": "Possibly dead Python function: cmd_validate_product_announcement", "shortDescription": {"text": "Possibly dead Python function: cmd_validate_product_announcement"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0a179ceaa3631c47", "name": "Possibly dead Python function: cmd_verify_release_state", "shortDescription": {"text": "Possibly dead Python function: cmd_verify_release_state"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-747a7f98bd5a161b", "name": "Possibly dead Python function: cmd_notes", "shortDescription": {"text": "Possibly dead Python function: cmd_notes"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f3667e6b2cc3d381", "name": "Possibly dead Python function: cmd_manifest", "shortDescription": {"text": "Possibly dead Python function: cmd_manifest"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3cdc4a98231c3ac6", "name": "Possibly dead Python function: cmd_current_commit", "shortDescription": {"text": "Possibly dead Python function: cmd_current_commit"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9c933ff43f7207b6", "name": "Possibly dead Python function: cmd_select_commit", "shortDescription": {"text": "Possibly dead Python function: cmd_select_commit"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-68daf75c5d48da41", "name": "Possibly dead Python function: cmd_range_base", "shortDescription": {"text": "Possibly dead Python function: cmd_range_base"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8a49e8e68b82289e", "name": "Possibly dead Python function: positive_int", "shortDescription": {"text": "Possibly dead Python function: positive_int"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee97896719e1a230", "name": "Possibly dead Python function: non_negative_float", "shortDescription": {"text": "Possibly dead Python function: non_negative_float"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c9be396773ed8154", "name": "Possibly dead Python function: register", "shortDescription": {"text": "Possibly dead Python function: register"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-84b7b224a9f6ecf6", "name": "GHSA-cq8v-f236-94qc: rand 0.8.5 \u2014 Cargo.lock", "shortDescription": {"text": "GHSA-cq8v-f236-94qc: rand 0.8.5 \u2014 Cargo.lock"}, "fullDescription": {"text": "Rand is unsound with a custom logger using rand::rng()\n\nIt has been reported (by @lopopolo) that the `rand` library is [unsound](https://rust-lang.github.io/unsafe-code-guidelines/glossary.html#soundness-of-code--of-a-library) (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met:\n\n- The `log` and `thread_rng` features are enabled\n- A [custom logger](https://docs.rs/log/latest/log/#implementing-a-logger) is defined\n- The custom logger accesses `rand::rng()` (previously `rand::thread_rng()`)\n\nPackage: rand\nInstalled: 0.8.5\nFixed in: 0.9.3, 0.10.1, 0.8.6\nSeverity: LOW\nFix: Upgrade rand to 0.9.3, 0.10.1, 0.8.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a8bc2302c6cbadfa", "name": "CVE-2026-50146: astro 5.18.1 \u2014 website/bun.lock", "shortDescription": {"text": "CVE-2026-50146: astro 5.18.1 \u2014 website/bun.lock"}, "fullDescription": {"text": "Astro: Reflected XSS via unescaped slot name\n\nAstro is a web framework. Prior to 6.3.3, when a component uses a client:* directive, Astro inserts named slot content into a data-astro-template attribute without HTML escaping the slot name allowing an attacker to break out of the attribute context and inject arbitrary HTML, resulting in reflected XSS during SSR. This vulnerability is fixed in 6.3.3.\n\nPackage: astro\nInstalled: 5.18.1\nFixed in: 6.3.3\nSeverity: HIGH\nFix: Upgrade astro to 6.3.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ac5021e62a687ae3", "name": "CVE-2026-54299: astro 5.18.1 \u2014 website/bun.lock", "shortDescription": {"text": "CVE-2026-54299: astro 5.18.1 \u2014 website/bun.lock"}, "fullDescription": {"text": "Astro: Host header SSRF in prerendered error page fetch\n\nAstro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/404 or /500 using export const prerender = true) fetch those pages over HTTP at runtime when an error occurs. The URL for this fetch is derived from request.url, which in turn gets its origin from the incoming Host header. When the Host header is not validated against allowedDomains, an attacker can point the fetch at an arbitrary host and read the response. This vulnerability is fixed in 6.4.6.\n\nPackage: astro\nInstalled: 5.18.1\nFixed in: 6.4.6\nSeverity: HIGH\nFix: Upgrade astro to 6.4.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d39f031dfa9b2304", "name": "CVE-2026-41067: astro 5.18.1 \u2014 website/bun.lock", "shortDescription": {"text": "CVE-2026-41067: astro 5.18.1 \u2014 website/bun.lock"}, "fullDescription": {"text": "Astro: XSS in define:vars via incomplete </script> tag sanitization\n\nAstro is a web framework. Prior to 6.1.6, the defineScriptVars function in Astro's server-side rendering pipeline uses a case-sensitive regex /<\\/script>/g to sanitize values injected into inline <script> tags via the define:vars directive. HTML parsers close <script> elements case-insensitively and also accept whitespace or / before the closing >, allowing an attacker to bypass the sanitization with payloads like </Script>, </script >, or </script/> and inject arbitrary HTML/JavaScript. This vu\n\nPackage: astro\nInstalled: 5.18.1\nFixed in: 6.1.6\nSeverity: MEDIUM\nFix: Upgrade astro to 6.1.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d04b55328d0a85c", "name": "CVE-2026-54298: astro 5.18.1 \u2014 website/bun.lock", "shortDescription": {"text": "CVE-2026-54298: astro 5.18.1 \u2014 website/bun.lock"}, "fullDescription": {"text": "Astro: XSS via Unescaped Attribute Names in Spread Props\n\nAstro is a web framework. Prior to 6.4.6, the spreadAttributes function in Astro's server-side rendering pipeline iterates over object keys and passes them directly to addAttribute, which interpolates the key into the HTML output without escaping. When a developer uses the spread syntax {...props} on an HTML element and the object keys come from an untrusted source (API, CMS, URL parameters), an attacker can inject arbitrary HTML attributes including event handlers like onmousemove, onclick, or \n\nPackage: astro\nInstalled: 5.18.1\nFixed in: 6.4.6\nSeverity: MEDIUM\nFix: Upgrade astro to 6.4.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4ceb865d9e56575c", "name": "CVE-2026-59729: astro 5.18.1 \u2014 website/bun.lock", "shortDescription": {"text": "CVE-2026-59729: astro 5.18.1 \u2014 website/bun.lock"}, "fullDescription": {"text": "Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)\n\n## Summary\n\nThe fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an `INVALID_ATTR_NAME_CHAR` guard to `addAttribute()` so that spread-prop attribute names containing `\"' >/=` or whitespace are dropped. A second attribute-rendering path, `renderHTMLElement()` in `packages/astro/src/runtime/server/render/dom.ts`, has its own inline attribute loop that does not go through `addAttribute()` and was not updated. It interpolates the attribute name unescaped and only escapes the value, so untrusted pr\n\nPackage: astro\nInstalled: 5.18.1\nFixed in: 7.0.6\nSeverity: MEDIUM\nFix: Upgrade astro to 7.0.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ee8bb124293b777b", "name": "GHSA-4g3v-8h47-v7g6: astro 5.18.1 \u2014 website/bun.lock", "shortDescription": {"text": "GHSA-4g3v-8h47-v7g6: astro 5.18.1 \u2014 website/bun.lock"}, "fullDescription": {"text": "Astro: Reflected XSS via unescaped View Transition animation properties\n\n## Summary\n\nAstro's server-side View Transition CSS generator interpolates animation properties into an inline `<style>` element without escaping them for the CSS and HTML contexts.\n\nAn attacker-controlled value passed to an animation property such as `duration` can contain a `</style>` sequence, terminate the generated style element, and inject arbitrary HTML or JavaScript.\n\nThis is similar to GHSA-8hv8-536x-4wqp, but exploits a different injection point: unescaped View Transition animation val\n\nPackage: astro\nInstalled: 5.18.1\nFixed in: 7.1.0\nSeverity: MEDIUM\nFix: Upgrade astro to 7.1.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-336e8d04612f580e", "name": "CVE-2026-45028: astro 5.18.1 \u2014 website/bun.lock", "shortDescription": {"text": "CVE-2026-45028: astro 5.18.1 \u2014 website/bun.lock"}, "fullDescription": {"text": "Astro: Server island encrypted parameters vulnerable to cross-component replay\n\nAstro is a web framework. Astro versions prior to 6.1.10 used AES-GCM encryption to protect the confidentiality and integrity of server island props and slots parameters, but did not bind the ciphertext to its intended component or parameter type. An attacker could replay one component's encrypted props (p) value as another component's slots (s) value, or vice versa. Since slots contain raw unescaped HTML while props may contain user-controlled values, this could lead to XSS in applications. Thi\n\nPackage: astro\nInstalled: 5.18.1\nFixed in: 6.1.10\nSeverity: LOW\nFix: Upgrade astro to 6.1.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d18e9509bc3736ef", "name": "CVE-2026-59727: astro 5.18.1 \u2014 website/bun.lock", "shortDescription": {"text": "CVE-2026-59727: astro 5.18.1 \u2014 website/bun.lock"}, "fullDescription": {"text": "Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands\n\n### Summary\n\nWhen a `transition:persist`, `transition:scope`, or `transition:persist-props` directive is applied to a client-hydrated (`client:*`) component, Astro copied the directive value onto the rendered `<astro-island>` element **without HTML-escaping it**. If a developer reflects attacker-controlled input into one of these directives, an attacker can break out of the attribute and inject arbitrary HTML/JavaScript into the server-rendered output, resulting in reflected cross-site scripting\n\nPackage: astro\nInstalled: 5.18.1\nFixed in: 7.0.4\nSeverity: LOW\nFix: Upgrade astro to 7.0.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6a7e20ba568c284a", "name": "GHSA-g7r4-m6w7-qqqr: esbuild 0.27.7 \u2014 website/bun.lock", "shortDescription": {"text": "GHSA-g7r4-m6w7-qqqr: esbuild 0.27.7 \u2014 website/bun.lock"}, "fullDescription": {"text": "esbuild allows arbitrary file read when running the development server on Windows\n\n### Summary\n\nThe development server contains a path traversal vulnerability on Windows when serving files from `servedir`.\n\nDue to the use of `path.Clean()` (which only normalizes forward-slash `/` separators) instead of a Windows-aware path normalization function, it is possible to craft requests using backslashes (`\\`) that bypass the intended directory containment logic. An attacker can escape the configured `servedir` root and access arbitrary files on the filesystem.\nThis issue affects Wind\n\nPackage: esbuild\nInstalled: 0.27.7\nFixed in: 0.28.1\nSeverity: LOW\nFix: Upgrade esbuild to 0.28.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3a595ac91daff841", "name": "CVE-2026-59869: js-yaml 4.1.1 \u2014 website/bun.lock", "shortDescription": {"text": "CVE-2026-59869: js-yaml 4.1.1 \u2014 website/bun.lock"}, "fullDescription": {"text": "js-yaml: js-yaml: Denial of Service via crafted YAML documents\n\njs-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.\n\nPackage: js-yaml\nInstalled: 4.1.1\nFixed in: 3.15.0, 4.3.0\nSeverity: HIGH\nFix: Upgrade js-yaml to 3.15.0, 4.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cab085176184d9ae", "name": "CVE-2026-53550: js-yaml 4.1.1 \u2014 website/bun.lock", "shortDescription": {"text": "CVE-2026-53550: js-yaml 4.1.1 \u2014 website/bun.lock"}, "fullDescription": {"text": "js-yaml: js-yaml: Denial of Service via crafted YAML merge keys\n\njs-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerabil\n\nPackage: js-yaml\nInstalled: 4.1.1\nFixed in: 4.2.0, 3.15.0\nSeverity: MEDIUM\nFix: Upgrade js-yaml to 4.2.0, 3.15.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3be26eca772432b4", "name": "GHSA-2p49-hgcm-8545: svgo 4.0.1 \u2014 website/bun.lock", "shortDescription": {"text": "GHSA-2p49-hgcm-8545: svgo 4.0.1 \u2014 website/bun.lock"}, "fullDescription": {"text": "SVGO removeScripts plugin leaves some executable scripts intact\n\n### Summary\n\nSVGO's removeScripts plugin (disabled by default) removes scripts from the SVG, however executable scripts were left intact in some cases. If a consumer relied on this plugin for sanitization and served them to users, these SVGs could open up doors to XSS.\n\n### Details\n\nSVGO has a plugin for removing scripts from an SVG, which removes:\n\n- `<script>` elements\n- JavaScript URIs (v4 and v3 only)\n- `on\u2026` event handlers (v4 and v3 only)\n\nWhile SVGO is not a sanitization library, SVGO con\n\nPackage: svgo\nInstalled: 4.0.1\nFixed in: 2.8.3, 3.3.4, 4.0.2\nSeverity: HIGH\nFix: Upgrade svgo to 2.8.3, 3.3.4, 4.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e6c5777d15840a4c", "name": "CVE-2026-53571: vite 6.4.2 \u2014 website/bun.lock", "shortDescription": {"text": "CVE-2026-53571: vite 6.4.2 \u2014 website/bun.lock"}, "fullDescription": {"text": "vite: `server.fs.deny` bypass on Windows alternate paths\n\nVite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite\u2019s dev server denies direct access to sensitive files through server.fs.deny, including entries such as .env, .env.*, and *.{crt,pem}. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied. Because of this, requests such as /.env::$DATA?raw a\n\nPackage: vite\nInstalled: 6.4.2\nFixed in: 8.0.16, 7.3.5, 6.4.3\nSeverity: HIGH\nFix: Upgrade vite to 8.0.16, 7.3.5, 6.4.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-71ef523e34e905ba", "name": "CVE-2026-53632: vite 6.4.2 \u2014 website/bun.lock", "shortDescription": {"text": "CVE-2026-53632: vite 6.4.2 \u2014 website/bun.lock"}, "fullDescription": {"text": "launch-editor: launch-editor: Credential compromise via NTLMv2 password hash leak through UNC path access\n\nlaunch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user\u2019s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. This vulnerability is fixed in 2.14.1.\n\nPackage: vite\nInstalled: 6.4.2\nFixed in: 8.0.16, 7.3.5, 6.4.3\nSeverity: MEDIUM\nFix: Upgrade vite to 8.0.16, 7.3.5, 6.4.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-217b62b037b302ba", "name": "DS-0002: Image user should not be 'root' \u2014 vendor/libghostty-vt/src/build/docker/debian/Dockerfile", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 vendor/libghostty-vt/src/build/docker/debian/Dockerfile"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: vendor/libghostty-vt/src/build/docker/debian/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ba13f340a4b17b0d", "name": "DS-0026: No HEALTHCHECK defined \u2014 vendor/libghostty-vt/src/build/docker/debian/Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 vendor/libghostty-vt/src/build/docker/debian/Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: vendor/libghostty-vt/src/build/docker/debian/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3e9c591df472b537", "name": "DS-0001: ':latest' tag used \u2014 vendor/libghostty-vt/src/build/docker/lib-c-docs/Dockerfile", "shortDescription": {"text": "DS-0001: ':latest' tag used \u2014 vendor/libghostty-vt/src/build/docker/lib-c-docs/Dockerfile"}, "fullDescription": {"text": "':latest' tag used\n\nSpecify a tag in the 'FROM' statement for image 'archlinux'\n\nRule: DS-0001\nSeverity: MEDIUM\nTarget: vendor/libghostty-vt/src/build/docker/lib-c-docs/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-86613441adc9d98d", "name": "DS-0002: Image user should not be 'root' \u2014 vendor/libghostty-vt/src/build/docker/lib-c-docs/Dockerfile", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 vendor/libghostty-vt/src/build/docker/lib-c-docs/Dockerfile"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: vendor/libghostty-vt/src/build/docker/lib-c-docs/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ff591ebd28d2a4b1", "name": "DS-0026: No HEALTHCHECK defined \u2014 vendor/libghostty-vt/src/build/docker/lib-c-docs/Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 vendor/libghostty-vt/src/build/docker/lib-c-docs/Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: vendor/libghostty-vt/src/build/docker/lib-c-docs/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-01014988ebc181af", "name": "Agent authority lacks a verifier contract: .codex/skills/herdr-pre-release-audit/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .codex/skills/herdr-pre-release-audit/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-58037e4f347c6988", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2cc9a64fc12a583d", "name": "Very large file: tests/api_ping.rs (2513 lines)", "shortDescription": {"text": "Very large file: tests/api_ping.rs (2513 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-187f626ed9bc68f4", "name": "Very large file: tests/live_handoff.rs (1791 lines)", "shortDescription": {"text": "Very large file: tests/live_handoff.rs (1791 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-733066b6722c19d2", "name": "Very large file: src/raw_input.rs (2498 lines)", "shortDescription": {"text": "Very large file: src/raw_input.rs (2498 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f9fa434212414915", "name": "Very large file: src/pane.rs (4042 lines)", "shortDescription": {"text": "Very large file: src/pane.rs (4042 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b3ac52a7d235a845", "name": "Very large file: src/ui.rs (1488 lines)", "shortDescription": {"text": "Very large file: src/ui.rs (1488 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3e93821fbaaf3127", "name": "Very large file: src/update.rs (3480 lines)", "shortDescription": {"text": "Very large file: src/update.rs (3480 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2e2b8e24cc035c95", "name": "Very large file: src/workspace.rs (1619 lines)", "shortDescription": {"text": "Very large file: src/workspace.rs (1619 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-050bdd837043c6dc", "name": "Very large file: src/kitty_graphics.rs (1755 lines)", "shortDescription": {"text": "Very large file: src/kitty_graphics.rs (1755 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-377b9570c5f8a2b5", "name": "Very large file: src/client/mod.rs (2969 lines)", "shortDescription": {"text": "Very large file: src/client/mod.rs (2969 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2ee4e0f10407c8ba", "name": "Very large file: src/client/input/windows_vti.rs (2144 lines)", "shortDescription": {"text": "Very large file: src/client/input/windows_vti.rs (2144 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d6da04850d53e489", "name": "Very large file: src/integration/tests.rs (3486 lines)", "shortDescription": {"text": "Very large file: src/integration/tests.rs (3486 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-87e7e0b978aabc43", "name": "Very large file: src/config/model.rs (1741 lines)", "shortDescription": {"text": "Very large file: src/config/model.rs (1741 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f3e7fe1d73f199d7", "name": "Very large file: src/config/keybinds.rs (2264 lines)", "shortDescription": {"text": "Very large file: src/config/keybinds.rs (2264 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5ca1a9789eaded3a", "name": "Very large file: src/api/server.rs (1357 lines)", "shortDescription": {"text": "Very large file: src/api/server.rs (1357 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-315b7f546497a285", "name": "Very large file: src/ui/sidebar.rs (2669 lines)", "shortDescription": {"text": "Very large file: src/ui/sidebar.rs (2669 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f99c63a7ef8e79fd", "name": "Very large file: src/ui/mobile.rs (1520 lines)", "shortDescription": {"text": "Very large file: src/ui/mobile.rs (1520 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f9909aa5499f9203", "name": "Very large file: src/cli/pane.rs (1767 lines)", "shortDescription": {"text": "Very large file: src/cli/pane.rs (1767 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3c4a07db0ee20d88", "name": "Very large file: src/cli/plugin.rs (1830 lines)", "shortDescription": {"text": "Very large file: src/cli/plugin.rs (1830 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f2a365ccbe233e7e", "name": "Very large file: src/remote/unix.rs (3111 lines)", "shortDescription": {"text": "Very large file: src/remote/unix.rs (3111 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e6bb2d9e3a8d4145", "name": "Very large file: src/persist/restore.rs (1714 lines)", "shortDescription": {"text": "Very large file: src/persist/restore.rs (1714 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0bf164ef5b25a015", "name": "Very large file: src/app/state.rs (2524 lines)", "shortDescription": {"text": "Very large file: src/app/state.rs (2524 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9989b4eed5d9bc3c", "name": "Very large file: src/app/worktrees.rs (2395 lines)", "shortDescription": {"text": "Very large file: src/app/worktrees.rs (2395 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-edd37ff8eddb0f94", "name": "Very large file: src/app/actions.rs (5699 lines)", "shortDescription": {"text": "Very large file: src/app/actions.rs (5699 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-434752c5e5ac34b2", "name": "Very large file: src/app/mod.rs (5854 lines)", "shortDescription": {"text": "Very large file: src/app/mod.rs (5854 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-049db9b337ea7fce", "name": "Very large file: src/app/api.rs (2249 lines)", "shortDescription": {"text": "Very large file: src/app/api.rs (2249 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f7d7145c74094919", "name": "Very large file: src/app/input/mouse.rs (3976 lines)", "shortDescription": {"text": "Very large file: src/app/input/mouse.rs (3976 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7d0436c4deb23cc6", "name": "Very large file: src/app/input/copy_mode.rs (2054 lines)", "shortDescription": {"text": "Very large file: src/app/input/copy_mode.rs (2054 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6aa7f6c319dc2d42", "name": "Very large file: src/app/input/sidebar.rs (1717 lines)", "shortDescription": {"text": "Very large file: src/app/input/sidebar.rs (1717 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-89540e5c7f1addff", "name": "Very large file: src/app/input/modal.rs (2094 lines)", "shortDescription": {"text": "Very large file: src/app/input/modal.rs (2094 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-42dc208789ed29be", "name": "Very large file: src/app/input/navigate.rs (3356 lines)", "shortDescription": {"text": "Very large file: src/app/input/navigate.rs (3356 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee603dc149db144c", "name": "Very large file: src/app/input/terminal.rs (1758 lines)", "shortDescription": {"text": "Very large file: src/app/input/terminal.rs (1758 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d6061910d2e05705", "name": "Very large file: src/app/api/panes.rs (3880 lines)", "shortDescription": {"text": "Very large file: src/app/api/panes.rs (3880 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1490c24faa28a725", "name": "Very large file: src/app/api/worktrees.rs (2252 lines)", "shortDescription": {"text": "Very large file: src/app/api/worktrees.rs (2252 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4b27ee0bb78402e4", "name": "Very large file: src/app/api/plugins/mod.rs (3661 lines)", "shortDescription": {"text": "Very large file: src/app/api/plugins/mod.rs (3661 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ababffd1b50f1a9a", "name": "Very large file: src/terminal/state.rs (4968 lines)", "shortDescription": {"text": "Very large file: src/terminal/state.rs (4968 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9fd0df58ac3b6d38", "name": "Very large file: src/server/headless.rs (9640 lines)", "shortDescription": {"text": "Very large file: src/server/headless.rs (9640 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a7702d04912972c6", "name": "Very large file: src/server/client_transport.rs (1564 lines)", "shortDescription": {"text": "Very large file: src/server/client_transport.rs (1564 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-22b1a7ee304ad163", "name": "Very large file: src/protocol/render_ansi.rs (1856 lines)", "shortDescription": {"text": "Very large file: src/protocol/render_ansi.rs (1856 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dd87d2851af33821", "name": "Very large file: src/protocol/wire.rs (2073 lines)", "shortDescription": {"text": "Very large file: src/protocol/wire.rs (2073 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f822b774c4c7c82d", "name": "Very large file: src/ghostty/bindings.rs (4240 lines)", "shortDescription": {"text": "Very large file: src/ghostty/bindings.rs (4240 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-10432fb9ca21cef4", "name": "Very large file: src/ghostty/mod.rs (3856 lines)", "shortDescription": {"text": "Very large file: src/ghostty/mod.rs (3856 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d30a1303d599c800", "name": "Very large file: src/pane/osc.rs (1520 lines)", "shortDescription": {"text": "Very large file: src/pane/osc.rs (1520 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-398a4453f028cb90", "name": "Very large file: src/pane/terminal.rs (5643 lines)", "shortDescription": {"text": "Very large file: src/pane/terminal.rs (5643 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "43 tests / 244 src (ratio 0.18)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 97 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 38 placeholder/mock markers across 11 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0e11703c3e958114", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/changelog.py:533", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/changelog.py:533"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-9b3f6d8c1fe9ffed", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/conventional_commits.py:24", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/conventional_commits.py:24"}, "fullDescription": {"text": "`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-40e493cfec4d3f04", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/preview.py:43", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/preview.py:43"}, "fullDescription": {"text": "`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-d9d2af2cfceaf923", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/vendor_libghostty_vt.py:33", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/vendor_libghostty_vt.py:33"}, "fullDescription": {"text": "`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-2322b864d9393574", "name": "Fire-and-forget `fetch()` has no rejection handler \u2014 website/src/scripts/stats-page.ts:571", "shortDescription": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 website/src/scripts/stats-page.ts:571"}, "fullDescription": {"text": "This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-1becf5a51e363df8", "name": "Fire-and-forget `fetch()` has no rejection handler \u2014 workers/plugin-marketplace/src/index.ts:89", "shortDescription": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 workers/plugin-marketplace/src/index.ts:89"}, "fullDescription": {"text": "This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same substantial AST body hash:\nscripts/verify_suspicious_keys.py:68:read_sequence, scripts/capture_keys.py:53:read_sequence, scripts/capture_key_matrix.py:92:read_sequence\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-41f558d2da1cf97a", "name": "Vulnerable dependency bincode 2.0.1: RUSTSEC-2025-0141", "shortDescription": {"text": "Vulnerable dependency bincode 2.0.1: RUSTSEC-2025-0141"}, "fullDescription": {"text": "OSV.dev reports `bincode` at version `2.0.1` (resolved in `Cargo.lock`) is affected by RUSTSEC-2025-0141.\n\nBincode is unmaintained\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2025-0141\nFix: upgrade `bincode` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-da7f74a8587dd31f", "name": "Vulnerable dependency astro 5.18.1: GHSA-2pvr-wf23-7pc7", "shortDescription": {"text": "Vulnerable dependency astro 5.18.1: GHSA-2pvr-wf23-7pc7"}, "fullDescription": {"text": "OSV.dev reports `astro` at version `5.18.1` (resolved in `website/bun.lock`) is affected by GHSA-2pvr-wf23-7pc7 (aka CVE-2026-54299).\n\nAstro: Host header SSRF in prerendered error page fetch\n\nAliases: CVE-2026-54299\nAdvisory: https://osv.dev/vulnerability/GHSA-2pvr-wf23-7pc7\nFix: upgrade `astro` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3e3703b3c20215b5", "name": "Vulnerable dependency astro 5.18.1: GHSA-4g3v-8h47-v7g6", "shortDescription": {"text": "Vulnerable dependency astro 5.18.1: GHSA-4g3v-8h47-v7g6"}, "fullDescription": {"text": "OSV.dev reports `astro` at version `5.18.1` (resolved in `website/bun.lock`) is affected by GHSA-4g3v-8h47-v7g6.\n\nAstro: Reflected XSS via unescaped View Transition animation properties\n\nAdvisory: https://osv.dev/vulnerability/GHSA-4g3v-8h47-v7g6\nFix: upgrade `astro` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c5e22eba0d741327", "name": "Vulnerable dependency astro 5.18.1: GHSA-7pw4-f3q4-r2p2", "shortDescription": {"text": "Vulnerable dependency astro 5.18.1: GHSA-7pw4-f3q4-r2p2"}, "fullDescription": {"text": "OSV.dev reports `astro` at version `5.18.1` (resolved in `website/bun.lock`) is affected by GHSA-7pw4-f3q4-r2p2 (aka CVE-2026-59727).\n\nAstro: Cross-site scripting via unescaped transition:* directive values on hydrated islands\n\nAliases: CVE-2026-59727\nAdvisory: https://osv.dev/vulnerability/GHSA-7pw4-f3q4-r2p2\nFix: upgrade `astro` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-70d218ebf6b08d6c", "name": "Vulnerable dependency astro 5.18.1: GHSA-8hv8-536x-4wqp", "shortDescription": {"text": "Vulnerable dependency astro 5.18.1: GHSA-8hv8-536x-4wqp"}, "fullDescription": {"text": "OSV.dev reports `astro` at version `5.18.1` (resolved in `website/bun.lock`) is affected by GHSA-8hv8-536x-4wqp (aka CVE-2026-50146).\n\nAstro: Reflected XSS via unescaped slot name\n\nAliases: CVE-2026-50146\nAdvisory: https://osv.dev/vulnerability/GHSA-8hv8-536x-4wqp\nFix: upgrade `astro` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-22708dc2e3079abf", "name": "Vulnerable dependency astro 5.18.1: GHSA-f48w-9m4c-m7f5", "shortDescription": {"text": "Vulnerable dependency astro 5.18.1: GHSA-f48w-9m4c-m7f5"}, "fullDescription": {"text": "OSV.dev reports `astro` at version `5.18.1` (resolved in `website/bun.lock`) is affected by GHSA-f48w-9m4c-m7f5 (aka CVE-2026-59729).\n\nAstro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)\n\nAliases: CVE-2026-59729\nAdvisory: https://osv.dev/vulnerability/GHSA-f48w-9m4c-m7f5\nFix: upgrade `astro` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8130ed85ab2e026b", "name": "Vulnerable dependency astro 5.18.1: GHSA-j687-52p2-xcff", "shortDescription": {"text": "Vulnerable dependency astro 5.18.1: GHSA-j687-52p2-xcff"}, "fullDescription": {"text": "OSV.dev reports `astro` at version `5.18.1` (resolved in `website/bun.lock`) is affected by GHSA-j687-52p2-xcff (aka CVE-2026-41067).\n\nAstro: XSS in define:vars via incomplete </script> tag sanitization\n\nAliases: CVE-2026-41067\nAdvisory: https://osv.dev/vulnerability/GHSA-j687-52p2-xcff\nFix: upgrade `astro` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-914d4b53b205b93b", "name": "Vulnerable dependency astro 5.18.1: GHSA-jrpj-wcv7-9fh9", "shortDescription": {"text": "Vulnerable dependency astro 5.18.1: GHSA-jrpj-wcv7-9fh9"}, "fullDescription": {"text": "OSV.dev reports `astro` at version `5.18.1` (resolved in `website/bun.lock`) is affected by GHSA-jrpj-wcv7-9fh9 (aka CVE-2026-54298).\n\nAstro: XSS via Unescaped Attribute Names in Spread Props\n\nAliases: CVE-2026-54298\nAdvisory: https://osv.dev/vulnerability/GHSA-jrpj-wcv7-9fh9\nFix: upgrade `astro` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f71e8149e4edc326", "name": "Vulnerable dependency astro 5.18.1: GHSA-xr5h-phrj-8vxv", "shortDescription": {"text": "Vulnerable dependency astro 5.18.1: GHSA-xr5h-phrj-8vxv"}, "fullDescription": {"text": "OSV.dev reports `astro` at version `5.18.1` (resolved in `website/bun.lock`) is affected by GHSA-xr5h-phrj-8vxv (aka CVE-2026-45028).\n\nAstro: Server island encrypted parameters vulnerable to cross-component replay\n\nAliases: CVE-2026-45028\nAdvisory: https://osv.dev/vulnerability/GHSA-xr5h-phrj-8vxv\nFix: upgrade `astro` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-38233fdd2b7e94b7", "name": "Vulnerable dependency anyhow 1.0.102: RUSTSEC-2026-0190", "shortDescription": {"text": "Vulnerable dependency anyhow 1.0.102: RUSTSEC-2026-0190"}, "fullDescription": {"text": "OSV.dev reports `anyhow` at version `1.0.102` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0190.\nNote: `anyhow` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nUnsoundness in `Error::downcast_mut()`\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2026-0190\nFix: upgrade `anyhow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-ca311fec250c1c42", "name": "Vulnerable dependency rand 0.8.5: GHSA-cq8v-f236-94qc", "shortDescription": {"text": "Vulnerable dependency rand 0.8.5: GHSA-cq8v-f236-94qc"}, "fullDescription": {"text": "OSV.dev reports `rand` at version `0.8.5` (resolved in `Cargo.lock`) is affected by GHSA-cq8v-f236-94qc.\nNote: `rand` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nRand is unsound with a custom logger using rand::rng()\n\nAliases: GHSA-cq8v-f236-94qc, RUSTSEC-2026-0097\nAdvisory: https://osv.dev/vulnerability/GHSA-cq8v-f236-94qc\nFix: upgrade `rand` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-4c749dc09b121152", "name": "Vulnerable dependency esbuild 0.27.7: GHSA-g7r4-m6w7-qqqr", "shortDescription": {"text": "Vulnerable dependency esbuild 0.27.7: GHSA-g7r4-m6w7-qqqr"}, "fullDescription": {"text": "OSV.dev reports `esbuild` at version `0.27.7` (resolved in `website/bun.lock`) is affected by GHSA-g7r4-m6w7-qqqr.\nNote: `esbuild` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nesbuild allows arbitrary file read when running the development server on Windows\n\nAdvisory: https://osv.dev/vulnerability/GHSA-g7r4-m6w7-qqqr\nFix: upgrade `esbuild` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-ae14f8684dd60b25", "name": "Vulnerable dependency js-yaml 4.1.1: GHSA-52cp-r559-cp3m", "shortDescription": {"text": "Vulnerable dependency js-yaml 4.1.1: GHSA-52cp-r559-cp3m"}, "fullDescription": {"text": "OSV.dev reports `js-yaml` at version `4.1.1` (resolved in `website/bun.lock`) is affected by GHSA-52cp-r559-cp3m (aka CVE-2026-59869).\nNote: `js-yaml` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\njs-yaml: YAML merge-key chains can force quadratic CPU consumption\n\nAliases: CVE-2026-59869\nAdvisory: https://osv.dev/vulnerability/GHSA-52cp-r559-cp3m\nFix: upgrade `js-yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-a38c3def4131d38e", "name": "Vulnerable dependency js-yaml 4.1.1: GHSA-h67p-54hq-rp68", "shortDescription": {"text": "Vulnerable dependency js-yaml 4.1.1: GHSA-h67p-54hq-rp68"}, "fullDescription": {"text": "OSV.dev reports `js-yaml` at version `4.1.1` (resolved in `website/bun.lock`) is affected by GHSA-h67p-54hq-rp68 (aka CVE-2026-53550).\nNote: `js-yaml` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nJS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases\n\nAliases: CVE-2026-53550\nAdvisory: https://osv.dev/vulnerability/GHSA-h67p-54hq-rp68\nFix: upgrade `js-yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-6b33ff17773455ad", "name": "Dependency bincode is a major version behind", "shortDescription": {"text": "Dependency bincode is a major version behind"}, "fullDescription": {"text": "`bincode` is pinned at `2` in `Cargo.toml` while the latest release on the cargo registry is `3.0.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `bincode` to `3.0.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-3caa978a75ed9736", "name": "Dependency toml is a major version behind", "shortDescription": {"text": "Dependency toml is a major version behind"}, "fullDescription": {"text": "`toml` is pinned at `0.8` in `Cargo.toml` while the latest release on the cargo registry is `1.1.3+spec-1.1.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `toml` to `1.1.3+spec-1.1.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-985d63888e9ce01b", "name": "Dependency astro is two or more major versions behind", "shortDescription": {"text": "Dependency astro is two or more major versions behind"}, "fullDescription": {"text": "`astro` is pinned at `5.0.0` in `website/package.json` while the latest release on the npm registry is `7.1.3` \u2014 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `astro` to `7.1.3`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}]}}, "automationDetails": {"id": "repobility/30779"}, "properties": {"repository": "ogulcancelik/herdr", "repoUrl": "https://github.com/ogulcancelik/herdr", "branch": "main"}, "results": [{"ruleId": "scanner-6aa9a4dc34dbf30d", "level": "note", "message": {"text": "Possibly dead Python function: cmd_prepare"}, "properties": {"repobilityId": "402dc0c6529cd49a", "scanner": "scanner-primary", "fingerprint": "6aa9a4dc34dbf30d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/changelog.py:562"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6544b6050f193b1d", "level": "note", "message": {"text": "Possibly dead Python function: cmd_extract"}, "properties": {"repobilityId": "a2c702c18254303f", "scanner": "scanner-primary", "fingerprint": "6544b6050f193b1d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/changelog.py:570"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4c32693868b4d942", "level": "note", "message": {"text": "Possibly dead Python function: cmd_sync_latest_json"}, "properties": {"repobilityId": "72873489db7ccb61", "scanner": "scanner-primary", "fingerprint": "4c32693868b4d942", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/changelog.py:580"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9701e724dca54920", "level": "note", "message": {"text": "Possibly dead Python function: cmd_validate_product_announcement"}, "properties": {"repobilityId": "54400465aaeed1a0", "scanner": "scanner-primary", "fingerprint": "9701e724dca54920", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/changelog.py:623"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0a179ceaa3631c47", "level": "note", "message": {"text": "Possibly dead Python function: cmd_verify_release_state"}, "properties": {"repobilityId": "608282c3329827aa", "scanner": "scanner-primary", "fingerprint": "0a179ceaa3631c47", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/changelog.py:634"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-747a7f98bd5a161b", "level": "note", "message": {"text": "Possibly dead Python function: cmd_notes"}, "properties": {"repobilityId": "cb0e0589d588d5e5", "scanner": "scanner-primary", "fingerprint": "747a7f98bd5a161b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/preview.py:244"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f3667e6b2cc3d381", "level": "note", "message": {"text": "Possibly dead Python function: cmd_manifest"}, "properties": {"repobilityId": "e15baa1ff37ac693", "scanner": "scanner-primary", "fingerprint": "f3667e6b2cc3d381", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/preview.py:251"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3cdc4a98231c3ac6", "level": "note", "message": {"text": "Possibly dead Python function: cmd_current_commit"}, "properties": {"repobilityId": "b3958e28a149df00", "scanner": "scanner-primary", "fingerprint": "3cdc4a98231c3ac6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/preview.py:271"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9c933ff43f7207b6", "level": "note", "message": {"text": "Possibly dead Python function: cmd_select_commit"}, "properties": {"repobilityId": "ae9f0307f93c7968", "scanner": "scanner-primary", "fingerprint": "9c933ff43f7207b6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/preview.py:278"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-68daf75c5d48da41", "level": "note", "message": {"text": "Possibly dead Python function: cmd_range_base"}, "properties": {"repobilityId": "896a4e459ec311d1", "scanner": "scanner-primary", "fingerprint": "68daf75c5d48da41", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/preview.py:283"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8a49e8e68b82289e", "level": "note", "message": {"text": "Possibly dead Python function: positive_int"}, "properties": {"repobilityId": "4bd4f862ce15138a", "scanner": "scanner-primary", "fingerprint": "8a49e8e68b82289e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/capture_agent_screen.py:163"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ee97896719e1a230", "level": "note", "message": {"text": "Possibly dead Python function: non_negative_float"}, "properties": {"repobilityId": "3e8724ba2f0a0fb9", "scanner": "scanner-primary", "fingerprint": "ee97896719e1a230", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/capture_agent_screen.py:170"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c9be396773ed8154", "level": "note", "message": {"text": "Possibly dead Python function: register"}, "properties": {"repobilityId": "3dcfff96740bd31f", "scanner": "scanner-primary", "fingerprint": "c9be396773ed8154", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/integration/assets/hermes/__init__.py:86"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-84b7b224a9f6ecf6", "level": "note", "message": {"text": "GHSA-cq8v-f236-94qc: rand 0.8.5 \u2014 Cargo.lock"}, "properties": {"repobilityId": "327289a7bfee0a2a", "scanner": "scanner-primary", "fingerprint": "84b7b224a9f6ecf6", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-cq8v-f236-94qc"]}}, {"ruleId": "scanner-a8bc2302c6cbadfa", "level": "error", "message": {"text": "CVE-2026-50146: astro 5.18.1 \u2014 website/bun.lock"}, "properties": {"repobilityId": "8144076d3b1753f5", "scanner": "scanner-primary", "fingerprint": "a8bc2302c6cbadfa", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-50146"]}}, {"ruleId": "scanner-ac5021e62a687ae3", "level": "error", "message": {"text": "CVE-2026-54299: astro 5.18.1 \u2014 website/bun.lock"}, "properties": {"repobilityId": "0800644685871443", "scanner": "scanner-primary", "fingerprint": "ac5021e62a687ae3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54299"]}}, {"ruleId": "scanner-d39f031dfa9b2304", "level": "warning", "message": {"text": "CVE-2026-41067: astro 5.18.1 \u2014 website/bun.lock"}, "properties": {"repobilityId": "53df60436703c51a", "scanner": "scanner-primary", "fingerprint": "d39f031dfa9b2304", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41067"]}}, {"ruleId": "scanner-2d04b55328d0a85c", "level": "warning", "message": {"text": "CVE-2026-54298: astro 5.18.1 \u2014 website/bun.lock"}, "properties": {"repobilityId": "7dcd683c112d4e8e", "scanner": "scanner-primary", "fingerprint": "2d04b55328d0a85c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54298"]}}, {"ruleId": "scanner-4ceb865d9e56575c", "level": "warning", "message": {"text": "CVE-2026-59729: astro 5.18.1 \u2014 website/bun.lock"}, "properties": {"repobilityId": "1b6e4ece6fde700f", "scanner": "scanner-primary", "fingerprint": "4ceb865d9e56575c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59729"]}}, {"ruleId": "scanner-ee8bb124293b777b", "level": "warning", "message": {"text": "GHSA-4g3v-8h47-v7g6: astro 5.18.1 \u2014 website/bun.lock"}, "properties": {"repobilityId": "6b2a1de33824c805", "scanner": "scanner-primary", "fingerprint": "ee8bb124293b777b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-4g3v-8h47-v7g6"]}}, {"ruleId": "scanner-336e8d04612f580e", "level": "note", "message": {"text": "CVE-2026-45028: astro 5.18.1 \u2014 website/bun.lock"}, "properties": {"repobilityId": "f79e08c02d113005", "scanner": "scanner-primary", "fingerprint": "336e8d04612f580e", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45028"]}}, {"ruleId": "scanner-d18e9509bc3736ef", "level": "note", "message": {"text": "CVE-2026-59727: astro 5.18.1 \u2014 website/bun.lock"}, "properties": {"repobilityId": "70b32c46a20933f1", "scanner": "scanner-primary", "fingerprint": "d18e9509bc3736ef", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59727"]}}, {"ruleId": "scanner-6a7e20ba568c284a", "level": "note", "message": {"text": "GHSA-g7r4-m6w7-qqqr: esbuild 0.27.7 \u2014 website/bun.lock"}, "properties": {"repobilityId": "05f6bbe9c3690e24", "scanner": "scanner-primary", "fingerprint": "6a7e20ba568c284a", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-g7r4-m6w7-qqqr"]}}, {"ruleId": "scanner-3a595ac91daff841", "level": "error", "message": {"text": "CVE-2026-59869: js-yaml 4.1.1 \u2014 website/bun.lock"}, "properties": {"repobilityId": "e5d8d33c2801ab73", "scanner": "scanner-primary", "fingerprint": "3a595ac91daff841", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59869"]}}, {"ruleId": "scanner-cab085176184d9ae", "level": "warning", "message": {"text": "CVE-2026-53550: js-yaml 4.1.1 \u2014 website/bun.lock"}, "properties": {"repobilityId": "6a10745823b1e465", "scanner": "scanner-primary", "fingerprint": "cab085176184d9ae", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53550"]}}, {"ruleId": "scanner-3be26eca772432b4", "level": "error", "message": {"text": "GHSA-2p49-hgcm-8545: svgo 4.0.1 \u2014 website/bun.lock"}, "properties": {"repobilityId": "9f39ee56f86b26e2", "scanner": "scanner-primary", "fingerprint": "3be26eca772432b4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-2p49-hgcm-8545"]}}, {"ruleId": "scanner-e6c5777d15840a4c", "level": "error", "message": {"text": "CVE-2026-53571: vite 6.4.2 \u2014 website/bun.lock"}, "properties": {"repobilityId": "886b96166c6c944f", "scanner": "scanner-primary", "fingerprint": "e6c5777d15840a4c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53571"]}}, {"ruleId": "scanner-71ef523e34e905ba", "level": "warning", "message": {"text": "CVE-2026-53632: vite 6.4.2 \u2014 website/bun.lock"}, "properties": {"repobilityId": "d2bb70996786ff26", "scanner": "scanner-primary", "fingerprint": "71ef523e34e905ba", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53632"]}}, {"ruleId": "scanner-217b62b037b302ba", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 vendor/libghostty-vt/src/build/docker/debian/Dockerfile"}, "properties": {"repobilityId": "ce057253eb593de8", "scanner": "scanner-primary", "fingerprint": "217b62b037b302ba", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-ba13f340a4b17b0d", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 vendor/libghostty-vt/src/build/docker/debian/Dockerfile"}, "properties": {"repobilityId": "72d72828ba0aca50", "scanner": "scanner-primary", "fingerprint": "ba13f340a4b17b0d", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-3e9c591df472b537", "level": "warning", "message": {"text": "DS-0001: ':latest' tag used \u2014 vendor/libghostty-vt/src/build/docker/lib-c-docs/Dockerfile"}, "properties": {"repobilityId": "7a73d0c05185cd50", "scanner": "scanner-primary", "fingerprint": "3e9c591df472b537", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-86613441adc9d98d", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 vendor/libghostty-vt/src/build/docker/lib-c-docs/Dockerfile"}, "properties": {"repobilityId": "653db75c74e2df78", "scanner": "scanner-primary", "fingerprint": "86613441adc9d98d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-ff591ebd28d2a4b1", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 vendor/libghostty-vt/src/build/docker/lib-c-docs/Dockerfile"}, "properties": {"repobilityId": "f52698d12d46050d", "scanner": "scanner-primary", "fingerprint": "ff591ebd28d2a4b1", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-01014988ebc181af", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .codex/skills/herdr-pre-release-audit/SKILL.md"}, "properties": {"repobilityId": "26d6763777526be3", "scanner": "scanner-primary", "fingerprint": "01014988ebc181af", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "codex_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".codex/skills/herdr-pre-release-audit/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-58037e4f347c6988", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "a6ff97de3bf3cdb2", "scanner": "scanner-primary", "fingerprint": "58037e4f347c6988", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/preview.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2cc9a64fc12a583d", "level": "note", "message": {"text": "Very large file: tests/api_ping.rs (2513 lines)"}, "properties": {"repobilityId": "e32452d14bb147f2", "scanner": "scanner-primary", "fingerprint": "2cc9a64fc12a583d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-187f626ed9bc68f4", "level": "note", "message": {"text": "Very large file: tests/live_handoff.rs (1791 lines)"}, "properties": {"repobilityId": "06090561cae087af", "scanner": "scanner-primary", "fingerprint": "187f626ed9bc68f4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-733066b6722c19d2", "level": "note", "message": {"text": "Very large file: src/raw_input.rs (2498 lines)"}, "properties": {"repobilityId": "cb2613d66023b581", "scanner": "scanner-primary", "fingerprint": "733066b6722c19d2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f9fa434212414915", "level": "note", "message": {"text": "Very large file: src/pane.rs (4042 lines)"}, "properties": {"repobilityId": "cca5de8bd46b8427", "scanner": "scanner-primary", "fingerprint": "f9fa434212414915", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b3ac52a7d235a845", "level": "note", "message": {"text": "Very large file: src/ui.rs (1488 lines)"}, "properties": {"repobilityId": "d26c209be8a9357b", "scanner": "scanner-primary", "fingerprint": "b3ac52a7d235a845", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3e93821fbaaf3127", "level": "note", "message": {"text": "Very large file: src/update.rs (3480 lines)"}, "properties": {"repobilityId": "33f5f1b5ccee83a8", "scanner": "scanner-primary", "fingerprint": "3e93821fbaaf3127", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2e2b8e24cc035c95", "level": "note", "message": {"text": "Very large file: src/workspace.rs (1619 lines)"}, "properties": {"repobilityId": "2b439755e5eb6fe9", "scanner": "scanner-primary", "fingerprint": "2e2b8e24cc035c95", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-050bdd837043c6dc", "level": "note", "message": {"text": "Very large file: src/kitty_graphics.rs (1755 lines)"}, "properties": {"repobilityId": "707f49bc0f0cc82f", "scanner": "scanner-primary", "fingerprint": "050bdd837043c6dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-377b9570c5f8a2b5", "level": "note", "message": {"text": "Very large file: src/client/mod.rs (2969 lines)"}, "properties": {"repobilityId": "307aaa460d6cbd35", "scanner": "scanner-primary", "fingerprint": "377b9570c5f8a2b5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2ee4e0f10407c8ba", "level": "note", "message": {"text": "Very large file: src/client/input/windows_vti.rs (2144 lines)"}, "properties": {"repobilityId": "642a41d24b4ee13c", "scanner": "scanner-primary", "fingerprint": "2ee4e0f10407c8ba", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d6da04850d53e489", "level": "note", "message": {"text": "Very large file: src/integration/tests.rs (3486 lines)"}, "properties": {"repobilityId": "821f0003f3b2a26f", "scanner": "scanner-primary", "fingerprint": "d6da04850d53e489", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-87e7e0b978aabc43", "level": "note", "message": {"text": "Very large file: src/config/model.rs (1741 lines)"}, "properties": {"repobilityId": "1d7e1b610eb5ecab", "scanner": "scanner-primary", "fingerprint": "87e7e0b978aabc43", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f3e7fe1d73f199d7", "level": "note", "message": {"text": "Very large file: src/config/keybinds.rs (2264 lines)"}, "properties": {"repobilityId": "06a33397e50fc2b3", "scanner": "scanner-primary", "fingerprint": "f3e7fe1d73f199d7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5ca1a9789eaded3a", "level": "note", "message": {"text": "Very large file: src/api/server.rs (1357 lines)"}, "properties": {"repobilityId": "509ae8fb2acfe011", "scanner": "scanner-primary", "fingerprint": "5ca1a9789eaded3a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-315b7f546497a285", "level": "note", "message": {"text": "Very large file: src/ui/sidebar.rs (2669 lines)"}, "properties": {"repobilityId": "da642e756897c42d", "scanner": "scanner-primary", "fingerprint": "315b7f546497a285", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f99c63a7ef8e79fd", "level": "note", "message": {"text": "Very large file: src/ui/mobile.rs (1520 lines)"}, "properties": {"repobilityId": "1684e60a0d2091c7", "scanner": "scanner-primary", "fingerprint": "f99c63a7ef8e79fd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f9909aa5499f9203", "level": "note", "message": {"text": "Very large file: src/cli/pane.rs (1767 lines)"}, "properties": {"repobilityId": "fcc17a3555037148", "scanner": "scanner-primary", "fingerprint": "f9909aa5499f9203", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3c4a07db0ee20d88", "level": "note", "message": {"text": "Very large file: src/cli/plugin.rs (1830 lines)"}, "properties": {"repobilityId": "43d6e954f6ec5689", "scanner": "scanner-primary", "fingerprint": "3c4a07db0ee20d88", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f2a365ccbe233e7e", "level": "note", "message": {"text": "Very large file: src/remote/unix.rs (3111 lines)"}, "properties": {"repobilityId": "cec5e8f0edbd125a", "scanner": "scanner-primary", "fingerprint": "f2a365ccbe233e7e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e6bb2d9e3a8d4145", "level": "note", "message": {"text": "Very large file: src/persist/restore.rs (1714 lines)"}, "properties": {"repobilityId": "2c7c7d6117478ff1", "scanner": "scanner-primary", "fingerprint": "e6bb2d9e3a8d4145", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0bf164ef5b25a015", "level": "note", "message": {"text": "Very large file: src/app/state.rs (2524 lines)"}, "properties": {"repobilityId": "bbc73571d0283bb8", "scanner": "scanner-primary", "fingerprint": "0bf164ef5b25a015", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9989b4eed5d9bc3c", "level": "note", "message": {"text": "Very large file: src/app/worktrees.rs (2395 lines)"}, "properties": {"repobilityId": "0fb3720e08f1faab", "scanner": "scanner-primary", "fingerprint": "9989b4eed5d9bc3c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-edd37ff8eddb0f94", "level": "note", "message": {"text": "Very large file: src/app/actions.rs (5699 lines)"}, "properties": {"repobilityId": "bc1ca56cdbf5f350", "scanner": "scanner-primary", "fingerprint": "edd37ff8eddb0f94", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-434752c5e5ac34b2", "level": "note", "message": {"text": "Very large file: src/app/mod.rs (5854 lines)"}, "properties": {"repobilityId": "f99be9e995789c9b", "scanner": "scanner-primary", "fingerprint": "434752c5e5ac34b2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-049db9b337ea7fce", "level": "note", "message": {"text": "Very large file: src/app/api.rs (2249 lines)"}, "properties": {"repobilityId": "f153446671f1fee1", "scanner": "scanner-primary", "fingerprint": "049db9b337ea7fce", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f7d7145c74094919", "level": "note", "message": {"text": "Very large file: src/app/input/mouse.rs (3976 lines)"}, "properties": {"repobilityId": "13b5fe9ce7820e4e", "scanner": "scanner-primary", "fingerprint": "f7d7145c74094919", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7d0436c4deb23cc6", "level": "note", "message": {"text": "Very large file: src/app/input/copy_mode.rs (2054 lines)"}, "properties": {"repobilityId": "51dee60d34fcb352", "scanner": "scanner-primary", "fingerprint": "7d0436c4deb23cc6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6aa7f6c319dc2d42", "level": "note", "message": {"text": "Very large file: src/app/input/sidebar.rs (1717 lines)"}, "properties": {"repobilityId": "043fadc764c21ff3", "scanner": "scanner-primary", "fingerprint": "6aa7f6c319dc2d42", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-89540e5c7f1addff", "level": "note", "message": {"text": "Very large file: src/app/input/modal.rs (2094 lines)"}, "properties": {"repobilityId": "119d26896b7c6859", "scanner": "scanner-primary", "fingerprint": "89540e5c7f1addff", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-42dc208789ed29be", "level": "note", "message": {"text": "Very large file: src/app/input/navigate.rs (3356 lines)"}, "properties": {"repobilityId": "e73cb5f89280d797", "scanner": "scanner-primary", "fingerprint": "42dc208789ed29be", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ee603dc149db144c", "level": "note", "message": {"text": "Very large file: src/app/input/terminal.rs (1758 lines)"}, "properties": {"repobilityId": "38370ac3a6e0d547", "scanner": "scanner-primary", "fingerprint": "ee603dc149db144c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d6061910d2e05705", "level": "note", "message": {"text": "Very large file: src/app/api/panes.rs (3880 lines)"}, "properties": {"repobilityId": "408a1ffccb67857b", "scanner": "scanner-primary", "fingerprint": "d6061910d2e05705", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1490c24faa28a725", "level": "note", "message": {"text": "Very large file: src/app/api/worktrees.rs (2252 lines)"}, "properties": {"repobilityId": "ddb77defb39ded75", "scanner": "scanner-primary", "fingerprint": "1490c24faa28a725", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4b27ee0bb78402e4", "level": "note", "message": {"text": "Very large file: src/app/api/plugins/mod.rs (3661 lines)"}, "properties": {"repobilityId": "6159dbeef43ae59f", "scanner": "scanner-primary", "fingerprint": "4b27ee0bb78402e4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ababffd1b50f1a9a", "level": "note", "message": {"text": "Very large file: src/terminal/state.rs (4968 lines)"}, "properties": {"repobilityId": "d3292499a38221e8", "scanner": "scanner-primary", "fingerprint": "ababffd1b50f1a9a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9fd0df58ac3b6d38", "level": "note", "message": {"text": "Very large file: src/server/headless.rs (9640 lines)"}, "properties": {"repobilityId": "7c03502c39d4b974", "scanner": "scanner-primary", "fingerprint": "9fd0df58ac3b6d38", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a7702d04912972c6", "level": "note", "message": {"text": "Very large file: src/server/client_transport.rs (1564 lines)"}, "properties": {"repobilityId": "e9edbecfab00bbcc", "scanner": "scanner-primary", "fingerprint": "a7702d04912972c6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-22b1a7ee304ad163", "level": "note", "message": {"text": "Very large file: src/protocol/render_ansi.rs (1856 lines)"}, "properties": {"repobilityId": "20bc3b1a5ae4a6bc", "scanner": "scanner-primary", "fingerprint": "22b1a7ee304ad163", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-dd87d2851af33821", "level": "note", "message": {"text": "Very large file: src/protocol/wire.rs (2073 lines)"}, "properties": {"repobilityId": "f5d9b26c427a89dd", "scanner": "scanner-primary", "fingerprint": "dd87d2851af33821", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f822b774c4c7c82d", "level": "note", "message": {"text": "Very large file: src/ghostty/bindings.rs (4240 lines)"}, "properties": {"repobilityId": "7cbe632c0471d321", "scanner": "scanner-primary", "fingerprint": "f822b774c4c7c82d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-10432fb9ca21cef4", "level": "note", "message": {"text": "Very large file: src/ghostty/mod.rs (3856 lines)"}, "properties": {"repobilityId": "9dc2ed3b7e3c5cd5", "scanner": "scanner-primary", "fingerprint": "10432fb9ca21cef4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d30a1303d599c800", "level": "note", "message": {"text": "Very large file: src/pane/osc.rs (1520 lines)"}, "properties": {"repobilityId": "32cc797b61dadff5", "scanner": "scanner-primary", "fingerprint": "d30a1303d599c800", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-398a4453f028cb90", "level": "note", "message": {"text": "Very large file: src/pane/terminal.rs (5643 lines)"}, "properties": {"repobilityId": "61f698f23bf2e13c", "scanner": "scanner-primary", "fingerprint": "398a4453f028cb90", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "dd755e978a817d41", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "289587eb3cb08ff0", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "c89eaa6e683d0a92", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-0e11703c3e958114", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/changelog.py:533"}, "properties": {"repobilityId": "e9f0974040f38f2a", "scanner": "scanner-primary", "fingerprint": "0e11703c3e958114", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/changelog.py"}, "region": {"startLine": 533}}}]}, {"ruleId": "scanner-9b3f6d8c1fe9ffed", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/conventional_commits.py:24"}, "properties": {"repobilityId": "ad18c82278751a66", "scanner": "scanner-primary", "fingerprint": "9b3f6d8c1fe9ffed", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/conventional_commits.py"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-40e493cfec4d3f04", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/preview.py:43"}, "properties": {"repobilityId": "5bb654890e3a0a57", "scanner": "scanner-primary", "fingerprint": "40e493cfec4d3f04", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/preview.py"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-d9d2af2cfceaf923", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/vendor_libghostty_vt.py:33"}, "properties": {"repobilityId": "b49fa019f54526f2", "scanner": "scanner-primary", "fingerprint": "d9d2af2cfceaf923", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/vendor_libghostty_vt.py"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-2322b864d9393574", "level": "warning", "message": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 website/src/scripts/stats-page.ts:571"}, "properties": {"repobilityId": "44519ac8613663f3", "scanner": "scanner-primary", "fingerprint": "2322b864d9393574", "layer": "quality", "severity": "medium", "confidence": 0.9, "tags": ["integrity", "fragile-runtime", "robustness", "unhandled-promise"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/src/scripts/stats-page.ts"}, "region": {"startLine": 571}}}]}, {"ruleId": "scanner-1becf5a51e363df8", "level": "warning", "message": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 workers/plugin-marketplace/src/index.ts:89"}, "properties": {"repobilityId": "30a94fa73f7f5744", "scanner": "scanner-primary", "fingerprint": "1becf5a51e363df8", "layer": "quality", "severity": "medium", "confidence": 0.9, "tags": ["integrity", "fragile-runtime", "robustness", "unhandled-promise"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "workers/plugin-marketplace/src/index.ts"}, "region": {"startLine": 89}}}]}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "9ffddff2bba688db", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-41f558d2da1cf97a", "level": "warning", "message": {"text": "Vulnerable dependency bincode 2.0.1: RUSTSEC-2025-0141"}, "properties": {"repobilityId": "fa498b34417b942b", "scanner": "scanner-primary", "fingerprint": "41f558d2da1cf97a", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "RUSTSEC-2025-0141"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-da7f74a8587dd31f", "level": "error", "message": {"text": "Vulnerable dependency astro 5.18.1: GHSA-2pvr-wf23-7pc7"}, "properties": {"repobilityId": "34ac6fefd5348ad9", "scanner": "scanner-primary", "fingerprint": "da7f74a8587dd31f", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-2pvr-wf23-7pc7"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3e3703b3c20215b5", "level": "warning", "message": {"text": "Vulnerable dependency astro 5.18.1: GHSA-4g3v-8h47-v7g6"}, "properties": {"repobilityId": "24c2f5fa4ece0b27", "scanner": "scanner-primary", "fingerprint": "3e3703b3c20215b5", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-4g3v-8h47-v7g6"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c5e22eba0d741327", "level": "note", "message": {"text": "Vulnerable dependency astro 5.18.1: GHSA-7pw4-f3q4-r2p2"}, "properties": {"repobilityId": "68f4be92e014928c", "scanner": "scanner-primary", "fingerprint": "c5e22eba0d741327", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-7pw4-f3q4-r2p2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-70d218ebf6b08d6c", "level": "error", "message": {"text": "Vulnerable dependency astro 5.18.1: GHSA-8hv8-536x-4wqp"}, "properties": {"repobilityId": "b1fefe2049d72e6e", "scanner": "scanner-primary", "fingerprint": "70d218ebf6b08d6c", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-8hv8-536x-4wqp"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-22708dc2e3079abf", "level": "warning", "message": {"text": "Vulnerable dependency astro 5.18.1: GHSA-f48w-9m4c-m7f5"}, "properties": {"repobilityId": "822407e9d5db7ab0", "scanner": "scanner-primary", "fingerprint": "22708dc2e3079abf", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-f48w-9m4c-m7f5"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8130ed85ab2e026b", "level": "warning", "message": {"text": "Vulnerable dependency astro 5.18.1: GHSA-j687-52p2-xcff"}, "properties": {"repobilityId": "8bb1503868c6e3ce", "scanner": "scanner-primary", "fingerprint": "8130ed85ab2e026b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-j687-52p2-xcff"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-914d4b53b205b93b", "level": "warning", "message": {"text": "Vulnerable dependency astro 5.18.1: GHSA-jrpj-wcv7-9fh9"}, "properties": {"repobilityId": "146c1e16cf83cc4c", "scanner": "scanner-primary", "fingerprint": "914d4b53b205b93b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-jrpj-wcv7-9fh9"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f71e8149e4edc326", "level": "warning", "message": {"text": "Vulnerable dependency astro 5.18.1: GHSA-xr5h-phrj-8vxv"}, "properties": {"repobilityId": "026730fc2085f1ad", "scanner": "scanner-primary", "fingerprint": "f71e8149e4edc326", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-xr5h-phrj-8vxv"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-38233fdd2b7e94b7", "level": "warning", "message": {"text": "Vulnerable dependency anyhow 1.0.102: RUSTSEC-2026-0190"}, "properties": {"repobilityId": "b0f8e201981c9769", "scanner": "scanner-primary", "fingerprint": "38233fdd2b7e94b7", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2026-0190", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ca311fec250c1c42", "level": "warning", "message": {"text": "Vulnerable dependency rand 0.8.5: GHSA-cq8v-f236-94qc"}, "properties": {"repobilityId": "ba2e00fa76b72ddf", "scanner": "scanner-primary", "fingerprint": "ca311fec250c1c42", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-cq8v-f236-94qc", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4c749dc09b121152", "level": "note", "message": {"text": "Vulnerable dependency esbuild 0.27.7: GHSA-g7r4-m6w7-qqqr"}, "properties": {"repobilityId": "dbc426c2dd693105", "scanner": "scanner-primary", "fingerprint": "4c749dc09b121152", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-g7r4-m6w7-qqqr", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/bun.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ae14f8684dd60b25", "level": "error", "message": {"text": "Vulnerable dependency js-yaml 4.1.1: GHSA-52cp-r559-cp3m"}, "properties": {"repobilityId": "bb9354b1169e66e2", "scanner": "scanner-primary", "fingerprint": "ae14f8684dd60b25", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-52cp-r559-cp3m", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/bun.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a38c3def4131d38e", "level": "warning", "message": {"text": "Vulnerable dependency js-yaml 4.1.1: GHSA-h67p-54hq-rp68"}, "properties": {"repobilityId": "2e7af66f705e9148", "scanner": "scanner-primary", "fingerprint": "a38c3def4131d38e", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-h67p-54hq-rp68", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/bun.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6b33ff17773455ad", "level": "note", "message": {"text": "Dependency bincode is a major version behind"}, "properties": {"repobilityId": "68c77ea6d828d851", "scanner": "scanner-primary", "fingerprint": "6b33ff17773455ad", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3caa978a75ed9736", "level": "note", "message": {"text": "Dependency toml is a major version behind"}, "properties": {"repobilityId": "1c59f7e0e319939c", "scanner": "scanner-primary", "fingerprint": "3caa978a75ed9736", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-985d63888e9ce01b", "level": "warning", "message": {"text": "Dependency astro is two or more major versions behind"}, "properties": {"repobilityId": "8a61b90f6184121c", "scanner": "scanner-primary", "fingerprint": "985d63888e9ce01b", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "website/package.json"}, "region": {"startLine": 1}}}]}]}]}