{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-8e9ceefa74736267", "name": "Possibly dead Python function: s1_schema", "shortDescription": {"text": "Possibly dead Python function: s1_schema"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-db370ecf3eb6d144", "name": "Possibly dead Python function: s2_keywords", "shortDescription": {"text": "Possibly dead Python function: s2_keywords"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9eb4dcb8cde01672", "name": "Possibly dead Python function: s3_fpgate", "shortDescription": {"text": "Possibly dead Python function: s3_fpgate"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f2ccb07b7d99134a", "name": "Possibly dead Python function: s4_dedup", "shortDescription": {"text": "Possibly dead Python function: s4_dedup"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8accab62103e6b0e", "name": "Possibly dead Python function: s5_idnorm", "shortDescription": {"text": "Possibly dead Python function: s5_idnorm"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e57bd0010a9d9c9f", "name": "Possibly dead Python function: handle_initialize", "shortDescription": {"text": "Possibly dead Python function: handle_initialize"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ef9d0043d6ccf74e", "name": "Possibly dead Python function: handle_tools_list", "shortDescription": {"text": "Possibly dead Python function: handle_tools_list"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5328170619a5383b", "name": "Possibly dead Python function: handle_tools_call", "shortDescription": {"text": "Possibly dead Python function: handle_tools_call"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-360bd85c537932b6", "name": "Possibly dead Python function: scan_email", "shortDescription": {"text": "Possibly dead Python function: scan_email"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8964385a7843835e", "name": "Possibly dead Python function: cmd_info", "shortDescription": {"text": "Possibly dead Python function: cmd_info"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-04f9f133e63619a7", "name": "Possibly dead Python function: cmd_demo", "shortDescription": {"text": "Possibly dead Python function: cmd_demo"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-abb0fb7183351559", "name": "Possibly dead Python function: cmd_report", "shortDescription": {"text": "Possibly dead Python function: cmd_report"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a3872c6d5e9109e6", "name": "Possibly dead Python function: cmd_config", "shortDescription": {"text": "Possibly dead Python function: cmd_config"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2b26f1cfa5fa1553", "name": "Possibly dead Python function: extract_from_bytes", "shortDescription": {"text": "Possibly dead Python function: extract_from_bytes"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5a6a0e71ca2dbf63", "name": "Possibly dead Python function: scan_image", "shortDescription": {"text": "Possibly dead Python function: scan_image"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d70e0c0f9ef76917", "name": "Possibly dead Python function: extract_from_bytes", "shortDescription": {"text": "Possibly dead Python function: extract_from_bytes"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c043af0bfb5fa192", "name": "Possibly dead Python function: scan_qr", "shortDescription": {"text": "Possibly dead Python function: scan_qr"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-27c3f0208911c115", "name": "Insecure pattern 'private_key_in_repo' in attack-db/generate_db.py:67", "shortDescription": {"text": "Insecure pattern 'private_key_in_repo' in attack-db/generate_db.py:67"}, "fullDescription": {"text": "Found a known-risky pattern (private_key_in_repo). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-89f8376e05cc0aed", "name": "Insecure pattern 'eval_used' in attack-db/attacks/tool-output-poisoning/GLS-TOP-332-forged-evaluation-trace-execution-po", "shortDescription": {"text": "Insecure pattern 'eval_used' in attack-db/attacks/tool-output-poisoning/GLS-TOP-332-forged-evaluation-trace-execution-policy-evade.json:14"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8dfaee9620f450ae", "name": "Insecure pattern 'eval_used' in attack-db/attacks/agent-workflow-security/GLS-AW-048-guardrail-evaluation-fixture-tamper", "shortDescription": {"text": "Insecure pattern 'eval_used' in attack-db/attacks/agent-workflow-security/GLS-AW-048-guardrail-evaluation-fixture-tampering.json:27"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b3ea6a85282cc8fe", "name": "Insecure pattern 'eval_used' in attack-db/attacks/agent-workflow-security/GLS-AW-197-fake-ground-truth-evaluation-record", "shortDescription": {"text": "Insecure pattern 'eval_used' in attack-db/attacks/agent-workflow-security/GLS-AW-197-fake-ground-truth-evaluation-record-planting.json:29"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cbf142281c82f4b5", "name": "Insecure pattern 'eval_used' in attack-db/attacks/command-injection/GLS-CI-001-dangerous-shell-commands.json:25", "shortDescription": {"text": "Insecure pattern 'eval_used' in attack-db/attacks/command-injection/GLS-CI-001-dangerous-shell-commands.json:25"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-05a48b535bd7c71e", "name": "Insecure pattern 'subprocess_shell_true' in attack-db/attacks/command-injection/GLS-CI-004-unquoted-shell-interpolation-", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in attack-db/attacks/command-injection/GLS-CI-004-unquoted-shell-interpolation-injection.json:18"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1b69ba672ed33156", "name": "Insecure pattern 'eval_used' in attack-db/attacks/retrieval-poisoning/GLS-RP-257-forged-benchmark-appendix-trust-rerank.", "shortDescription": {"text": "Insecure pattern 'eval_used' in attack-db/attacks/retrieval-poisoning/GLS-RP-257-forged-benchmark-appendix-trust-rerank.json:14"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-dd014c4ed1a66092", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-python@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 202 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-53192380227f31a7", "name": "Network/subprocess call without timeout or try/except \u2014 fp_corpus_data.py:61", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 fp_corpus_data.py:61"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-512743f93a0e1020", "name": "Commented-code block (5 lines) in tests/test_false_positives.py:106", "shortDescription": {"text": "Commented-code block (5 lines) in tests/test_false_positives.py:106"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-753c4e6a6b33041c", "name": "Commented-code block (7 lines) in sunglasses/engine.py:86", "shortDescription": {"text": "Commented-code block (7 lines) in sunglasses/engine.py:86"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ac9269c6302a530e", "name": "Commented-code block (13 lines) in sunglasses/preprocessor.py:92", "shortDescription": {"text": "Commented-code block (13 lines) in sunglasses/preprocessor.py:92"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b873478d83570ee9", "name": "Commented-code block (5 lines) in sunglasses/cli.py:369", "shortDescription": {"text": "Commented-code block (5 lines) in sunglasses/cli.py:369"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c99efe7f24eb8f82", "name": "Commented-code block (7 lines) in sunglasses/sarif.py:29", "shortDescription": {"text": "Commented-code block (7 lines) in sunglasses/sarif.py:29"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsunglasses/cli.py:cmd_demo_live, sunglasses/cli.py:cmd_demo\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/20562"}, "properties": {"repository": "sunglasses-dev/sunglasses", "repoUrl": "https://github.com/sunglasses-dev/sunglasses", "branch": "main"}, "results": [{"ruleId": "scanner-8e9ceefa74736267", "level": "note", "message": {"text": "Possibly dead Python function: s1_schema"}, "properties": {"repobilityId": "6d6aebdaea53422a", "scanner": "scanner-primary", "fingerprint": "8e9ceefa74736267", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pattern_forge.py:133"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-db370ecf3eb6d144", "level": "note", "message": {"text": "Possibly dead Python function: s2_keywords"}, "properties": {"repobilityId": "97d40f115842d7d2", "scanner": "scanner-primary", "fingerprint": "db370ecf3eb6d144", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pattern_forge.py:181"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9eb4dcb8cde01672", "level": "note", "message": {"text": "Possibly dead Python function: s3_fpgate"}, "properties": {"repobilityId": "367f1e869587c420", "scanner": "scanner-primary", "fingerprint": "9eb4dcb8cde01672", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pattern_forge.py:208"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f2ccb07b7d99134a", "level": "note", "message": {"text": "Possibly dead Python function: s4_dedup"}, "properties": {"repobilityId": "e53346aa3b71ad23", "scanner": "scanner-primary", "fingerprint": "f2ccb07b7d99134a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pattern_forge.py:277"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8accab62103e6b0e", "level": "note", "message": {"text": "Possibly dead Python function: s5_idnorm"}, "properties": {"repobilityId": "c660cb03312351bf", "scanner": "scanner-primary", "fingerprint": "8accab62103e6b0e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pattern_forge.py:297"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e57bd0010a9d9c9f", "level": "note", "message": {"text": "Possibly dead Python function: handle_initialize"}, "properties": {"repobilityId": "747b5971de00af00", "scanner": "scanner-primary", "fingerprint": "e57bd0010a9d9c9f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sunglasses/mcp.py:50"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ef9d0043d6ccf74e", "level": "note", "message": {"text": "Possibly dead Python function: handle_tools_list"}, "properties": {"repobilityId": "72dc31523ed98130", "scanner": "scanner-primary", "fingerprint": "ef9d0043d6ccf74e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sunglasses/mcp.py:64"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5328170619a5383b", "level": "note", "message": {"text": "Possibly dead Python function: handle_tools_call"}, "properties": {"repobilityId": "881403c048ece791", "scanner": "scanner-primary", "fingerprint": "5328170619a5383b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sunglasses/mcp.py:130"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-360bd85c537932b6", "level": "note", "message": {"text": "Possibly dead Python function: scan_email"}, "properties": {"repobilityId": "8e96e81bafe687a3", "scanner": "scanner-primary", "fingerprint": "360bd85c537932b6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sunglasses/scanner.py:70"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8964385a7843835e", "level": "note", "message": {"text": "Possibly dead Python function: cmd_info"}, "properties": {"repobilityId": "641d6a86288803b5", "scanner": "scanner-primary", "fingerprint": "8964385a7843835e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sunglasses/cli.py:462"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-04f9f133e63619a7", "level": "note", "message": {"text": "Possibly dead Python function: cmd_demo"}, "properties": {"repobilityId": "47c1c7779ff609cc", "scanner": "scanner-primary", "fingerprint": "04f9f133e63619a7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sunglasses/cli.py:654"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-abb0fb7183351559", "level": "note", "message": {"text": "Possibly dead Python function: cmd_report"}, "properties": {"repobilityId": "e07177dc4040e77f", "scanner": "scanner-primary", "fingerprint": "abb0fb7183351559", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sunglasses/cli.py:775"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a3872c6d5e9109e6", "level": "note", "message": {"text": "Possibly dead Python function: cmd_config"}, "properties": {"repobilityId": "713345609a6761b5", "scanner": "scanner-primary", "fingerprint": "a3872c6d5e9109e6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sunglasses/cli.py:801"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2b26f1cfa5fa1553", "level": "note", "message": {"text": "Possibly dead Python function: extract_from_bytes"}, "properties": {"repobilityId": "9199bfb468da5e28", "scanner": "scanner-primary", "fingerprint": "2b26f1cfa5fa1553", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sunglasses/extractors/image.py:85"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5a6a0e71ca2dbf63", "level": "note", "message": {"text": "Possibly dead Python function: scan_image"}, "properties": {"repobilityId": "56a98e489046a53c", "scanner": "scanner-primary", "fingerprint": "5a6a0e71ca2dbf63", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sunglasses/extractors/image.py:231"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d70e0c0f9ef76917", "level": "note", "message": {"text": "Possibly dead Python function: extract_from_bytes"}, "properties": {"repobilityId": "9199bfb468da5e28", "scanner": "scanner-primary", "fingerprint": "d70e0c0f9ef76917", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sunglasses/extractors/qr.py:77"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c043af0bfb5fa192", "level": "note", "message": {"text": "Possibly dead Python function: scan_qr"}, "properties": {"repobilityId": "44521af0e607bf3c", "scanner": "scanner-primary", "fingerprint": "c043af0bfb5fa192", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sunglasses/extractors/qr.py:99"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-27c3f0208911c115", "level": "error", "message": {"text": "Insecure pattern 'private_key_in_repo' in attack-db/generate_db.py:67"}, "properties": {"repobilityId": "e7a9dcfabadc56cf", "scanner": "scanner-primary", "fingerprint": "27c3f0208911c115", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["owasp", "private_key_in_repo"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "attack-db/generate_db.py"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-89f8376e05cc0aed", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in attack-db/attacks/tool-output-poisoning/GLS-TOP-332-forged-evaluation-trace-execution-policy-evade.json:14"}, "properties": {"repobilityId": "ba0941a97d299153", "scanner": "scanner-primary", "fingerprint": "89f8376e05cc0aed", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "attack-db/attacks/tool-output-poisoning/GLS-TOP-332-forged-evaluation-trace-execution-policy-evade.json"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-8dfaee9620f450ae", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in attack-db/attacks/agent-workflow-security/GLS-AW-048-guardrail-evaluation-fixture-tampering.json:27"}, "properties": {"repobilityId": "90d5d602a18e65ef", "scanner": "scanner-primary", "fingerprint": "8dfaee9620f450ae", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "attack-db/attacks/agent-workflow-security/GLS-AW-048-guardrail-evaluation-fixture-tampering.json"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-b3ea6a85282cc8fe", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in attack-db/attacks/agent-workflow-security/GLS-AW-197-fake-ground-truth-evaluation-record-planting.json:29"}, "properties": {"repobilityId": "bb8db126ec06897b", "scanner": "scanner-primary", "fingerprint": "b3ea6a85282cc8fe", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "attack-db/attacks/agent-workflow-security/GLS-AW-197-fake-ground-truth-evaluation-record-planting.json"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-cbf142281c82f4b5", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in attack-db/attacks/command-injection/GLS-CI-001-dangerous-shell-commands.json:25"}, "properties": {"repobilityId": "99fe38e704859bb1", "scanner": "scanner-primary", "fingerprint": "cbf142281c82f4b5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "attack-db/attacks/command-injection/GLS-CI-001-dangerous-shell-commands.json"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-05a48b535bd7c71e", "level": "warning", "message": {"text": "Insecure pattern 'subprocess_shell_true' in attack-db/attacks/command-injection/GLS-CI-004-unquoted-shell-interpolation-injection.json:18"}, "properties": {"repobilityId": "20e04a394b1461c1", "scanner": "scanner-primary", "fingerprint": "05a48b535bd7c71e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "attack-db/attacks/command-injection/GLS-CI-004-unquoted-shell-interpolation-injection.json"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-1b69ba672ed33156", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in attack-db/attacks/retrieval-poisoning/GLS-RP-257-forged-benchmark-appendix-trust-rerank.json:14"}, "properties": {"repobilityId": "8cb59b539e7a467d", "scanner": "scanner-primary", "fingerprint": "1b69ba672ed33156", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "attack-db/attacks/retrieval-poisoning/GLS-RP-257-forged-benchmark-appendix-trust-rerank.json"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-dd014c4ed1a66092", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b67831f0eb3fe2c5", "scanner": "scanner-primary", "fingerprint": "dd014c4ed1a66092", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pattern-integrity.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "d63e818b10aaeb80", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "2f716fa17ad911f9", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "363bf9acc5479ed1", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-53192380227f31a7", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 fp_corpus_data.py:61"}, "properties": {"repobilityId": "9d6dcac766612b13", "scanner": "scanner-primary", "fingerprint": "53192380227f31a7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-512743f93a0e1020", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/test_false_positives.py:106"}, "properties": {"repobilityId": "c4b0e2b9bd470d0b", "scanner": "scanner-primary", "fingerprint": "512743f93a0e1020", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-753c4e6a6b33041c", "level": "none", "message": {"text": "Commented-code block (7 lines) in sunglasses/engine.py:86"}, "properties": {"repobilityId": "69dd7d18704d6264", "scanner": "scanner-primary", "fingerprint": "753c4e6a6b33041c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ac9269c6302a530e", "level": "none", "message": {"text": "Commented-code block (13 lines) in sunglasses/preprocessor.py:92"}, "properties": {"repobilityId": "2b8e39c74d10718a", "scanner": "scanner-primary", "fingerprint": "ac9269c6302a530e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b873478d83570ee9", "level": "none", "message": {"text": "Commented-code block (5 lines) in sunglasses/cli.py:369"}, "properties": {"repobilityId": "2f0196603819bf22", "scanner": "scanner-primary", "fingerprint": "b873478d83570ee9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c99efe7f24eb8f82", "level": "none", "message": {"text": "Commented-code block (7 lines) in sunglasses/sarif.py:29"}, "properties": {"repobilityId": "bd788f61e2878eef", "scanner": "scanner-primary", "fingerprint": "c99efe7f24eb8f82", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "dd69f69d9f84b90e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "5302fb06066a3d2d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}