{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "MINED111", "name": "[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or ", "shortDescription": {"text": "[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose."}, "fullDescription": {"text": "Either narrow the exception type, log the exception with `logger.exception(...)`, or re-raise after handling."}, "properties": {"scanner": "repobility-ast-engine", "category": "quality", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "AGT013", "name": "Agent auto-approve or skip-permissions mode is easy to enable", "shortDescription": {"text": "Agent auto-approve or skip-permissions mode is easy to enable"}, "fullDescription": {"text": "Require an explicit isolated profile for auto-approve modes. Keep safe defaults interactive, add visible warnings, and block these modes when the workspace contains secrets or production deploy credentials."}, "properties": {"scanner": "repobility-agent-runtime", "category": "quality", "severity": "medium", "confidence": 0.68, "cwe": "", "owasp": ""}}, {"id": "AGT007", "name": "localStorage write failures are swallowed silently", "shortDescription": {"text": "localStorage write failures are swallowed silently"}, "fullDescription": {"text": "Handle QuotaExceededError explicitly, show a toast or error state, and guide the user to export/clear old local data. Log non-quota failures for diagnostics."}, "properties": {"scanner": "repobility-agent-runtime", "category": "quality", "severity": "medium", "confidence": 0.8, "cwe": "", "owasp": ""}}, {"id": "SEC134", "name": "[SEC134] AI scaffold leftover \u2014 Lorem ipsum / example.com / John Doe in code: Lorem ipsum / John Doe / example.com left ", "shortDescription": {"text": "[SEC134] AI scaffold leftover \u2014 Lorem ipsum / example.com / John Doe in code: Lorem ipsum / John Doe / example.com left in non-test code. AI agents emit these as 'reasonable defaults' when they don't know real values; the human then forgets"}, "fullDescription": {"text": "Move dummy values to fixtures / seed files. In application code, require these to come from config or fail closed. Add a CI grep that rejects 'lorem ipsum' and 'example.com' outside test files."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC015", "name": "[SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is predictable.", "shortDescription": {"text": "[SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is predictable."}, "fullDescription": {"text": "Use secrets module (Python) or crypto.getRandomValues() (JS) for security-sensitive randomness."}, "properties": {"scanner": "repobility-threat-engine", "category": "crypto", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC007", "name": "[SEC007] Unsafe Deserialization: Unsafe deserialization can execute arbitrary code.", "shortDescription": {"text": "[SEC007] Unsafe Deserialization: Unsafe deserialization can execute arbitrary code."}, "fullDescription": {"text": "Use yaml.safe_load() instead of yaml.load(). Avoid pickle for untrusted data."}, "properties": {"scanner": "repobility-threat-engine", "category": "deserialization", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC136", "name": "[SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all exception block that silently returns ", "shortDescription": {"text": "[SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all exception block that silently returns success or no-ops. AI agents reach for this pattern when a flaky test or an unfamiliar API throws \u2014 wrap, swallow, retur"}, "fullDescription": {"text": "Catch the specific exception type, log at error level with full exception info, and return a failure-shaped result. If the operation is genuinely best-effort, log at warning and document why in a comment so the next reader (or scanner) knows."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC017", "name": "[SEC017] Unbounded Input to LLM/External API: User input is passed to an LLM or external AI API (OpenAI, Anthropic, etc.", "shortDescription": {"text": "[SEC017] Unbounded Input to LLM/External API: User input is passed to an LLM or external AI API (OpenAI, Anthropic, etc.) without any visible length or size validation. This creates two risks: (1) Cost abuse \u2014 an attacker can send extremely"}, "fullDescription": {"text": "1) Enforce a maximum input length BEFORE sending to the API: e.g. `if len(text) > 4000: return error`. 2) Use token counting (tiktoken for OpenAI, anthropic's token counter) to enforce token-level limits. 3) Set max_tokens on the API call to cap response cost. 4) Add rate limiting per user/IP to prevent automated abuse. 5) Monitor API spend with alerts for unusual usage patterns."}, "properties": {"scanner": "repobility-threat-engine", "category": "llm_injection", "severity": "medium", "confidence": 0.8, "cwe": "", "owasp": ""}}, {"id": "SEC087", "name": "[SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces", "shortDescription": {"text": "[SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces is predictable. Ported from gosec G404 / eslint detect-pseudoRandomBytes concept (Apache-2.0)."}, "fullDescription": {"text": "Use `crypto.randomBytes(32).toString('hex')` (Node) or `crypto.getRandomValues()` (browser)."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC045", "name": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a latera", "shortDescription": {"text": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use obj"}, "fullDescription": {"text": "For literal data structures: use ast.literal_eval(text) \u2014 only parses literals, raises on code.\nFor formula evaluation: use asteval or simpleeval (purpose-built sandboxes with allow-lists).\nFor Odoo: use odoo.tools.safe_eval(expr, locals_dict, mode='exec').\nIf you genuinely need to execute admin-stored code: require explicit super-admin permission AND log every execution with a stack trace."}, "properties": {"scanner": "repobility-threat-engine", "category": "injection", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "ERR002", "name": "[ERR002] Empty Catch Block: Empty catch blocks hide errors.", "shortDescription": {"text": "[ERR002] Empty Catch Block: Empty catch blocks hide errors."}, "fullDescription": {"text": "Log the error or rethrow it. Use console.error() at minimum."}, "properties": {"scanner": "repobility-threat-engine", "category": "error_handling", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC005", "name": "[SEC005] Command Injection Risk: Unsafe shell execution or eval of user input.", "shortDescription": {"text": "[SEC005] Command Injection Risk: Unsafe shell execution or eval of user input."}, "fullDescription": {"text": "Use subprocess with shell=False and a list of args. Never eval user input."}, "properties": {"scanner": "repobility-threat-engine", "category": "injection", "severity": "medium", "confidence": 0.5, "cwe": "", "owasp": ""}}, {"id": "COMP001", "name": "[COMP001] High cognitive complexity: Function `main` has cognitive complexity 21 (SonarSource scale). Cognitive complexi", "shortDescription": {"text": "[COMP001] High cognitive complexity: Function `main` has cognitive complexity 21 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand \u2014 nested branches, boolean chains, and recursion all weig"}, "fullDescription": {"text": "Extract nested branches into named helper functions; flatten early-return / guard clauses; replace long if/elif chains with dispatch dicts or polymorphism. SonarQube's threshold for 'should refactor' is 15 \u2014 yours is 21."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "medium", "confidence": 0.95, "cwe": "", "owasp": ""}}, {"id": "WEB005", "name": "robots.txt does not advertise a sitemap", "shortDescription": {"text": "robots.txt does not advertise a sitemap"}, "fullDescription": {"text": "Add `Sitemap: https://your-domain.example/sitemap.xml` to robots.txt."}, "properties": {"scanner": "repobility-web-presence", "category": "quality", "severity": "low", "confidence": 0.74, "cwe": "", "owasp": ""}}, {"id": "AIC003", "name": "Duplicated implementation block across source files", "shortDescription": {"text": "Duplicated implementation block across source files"}, "fullDescription": {"text": "Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used."}, "properties": {"scanner": "repobility-ai-code-hygiene", "category": "quality", "severity": "low", "confidence": 0.86, "cwe": "", "owasp": ""}}, {"id": "AIC002", "name": "Source file name looks like an AI patch artifact", "shortDescription": {"text": "Source file name looks like an AI patch artifact"}, "fullDescription": {"text": "Rename it to the domain concept it implements or merge it into the existing module it was meant to change."}, "properties": {"scanner": "repobility-ai-code-hygiene", "category": "quality", "severity": "low", "confidence": 0.62, "cwe": "", "owasp": ""}}, {"id": "SEC006", "name": "[SEC006] XSS Risk: Direct HTML injection without sanitization.", "shortDescription": {"text": "[SEC006] XSS Risk: Direct HTML injection without sanitization."}, "fullDescription": {"text": "Use textContent instead of innerHTML. Sanitize with DOMPurify."}, "properties": {"scanner": "repobility-threat-engine", "category": "injection", "severity": "low", "confidence": 0.4, "cwe": "", "owasp": ""}}, {"id": "MINED042", "name": "[MINED042] Cpp New Without Delete: C++ raw new without RAII / unique_ptr \u2014 memory leak risk.", "shortDescription": {"text": "[MINED042] Cpp New Without Delete: C++ raw new without RAII / unique_ptr \u2014 memory leak risk."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-401 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED057", "name": "[MINED057] Todo Bomb: Code path with a TODO/FIXME/HACK comment that gates correctness \u2014 left for later but never resolve", "shortDescription": {"text": "[MINED057] Todo Bomb: Code path with a TODO/FIXME/HACK comment that gates correctness \u2014 left for later but never resolved."}, "fullDescription": {"text": "Review and fix per the pattern semantics."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC016", "name": "[SEC016] LLM Prompt Injection \u2014 User Input in AI Prompt: User-supplied text is interpolated directly into an AI/LLM prom", "shortDescription": {"text": "[SEC016] LLM Prompt Injection \u2014 User Input in AI Prompt: User-supplied text is interpolated directly into an AI/LLM prompt (e.g. OpenAI, Anthropic, or local model). This is the AI equivalent of SQL injection: an attacker can craft input tha"}, "fullDescription": {"text": "1) Separate user content from instructions: use the 'user' role for user text and 'system' role for your instructions \u2014 never concatenate them into one string. 2) Validate and constrain: limit input length, strip control characters, and reject known injection patterns. 3) Use structured output (JSON mode / function calling) so the model returns data, not freeform actions. 4) Apply output validation: check the AI's response before acting on it. 5) Consider a prompt injection detection layer (e.g. Anthropic's constitutional AI, prompt-guard models)."}, "properties": {"scanner": "repobility-threat-engine", "category": "llm_injection", "severity": "info", "confidence": 0.1, "cwe": "", "owasp": ""}}, {"id": "MINED074", "name": "[MINED074] Ai Tell Fake Citation: Plausible-looking but non-existent URLs (e.g., docs.example.com/v2). Common AI halluci", "shortDescription": {"text": "[MINED074] Ai Tell Fake Citation: Plausible-looking but non-existent URLs (e.g., docs.example.com/v2). Common AI hallucination."}, "fullDescription": {"text": "Review and fix per the pattern semantics."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED054", "name": "[MINED054] Ts As Any (and 49 more): Same pattern found in 49 additional files. Review if needed.", "shortDescription": {"text": "[MINED054] Ts As Any (and 49 more): Same pattern found in 49 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-704 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "SEC114", "name": "[SEC114] path.join / Path() on user-controlled segment without containment check (and 3 more): Same pattern found in 3 a", "shortDescription": {"text": "[SEC114] path.join / Path() on user-controlled segment without containment check (and 3 more): Same pattern found in 3 additional files. Review if needed."}, "fullDescription": {"text": "After joining, re-check containment: `if !strings.HasPrefix(filepath.Clean(joined), filepath.Clean(baseDir)+string(os.PathSeparator)) { error }`. In Node: `path.resolve(base, x); if (!resolved.startsWith(base + path.sep)) throw`."}, "properties": {"scanner": "repobility-threat-engine", "category": "path_traversal", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED052", "name": "[MINED052] Ts Any Typed (and 133 more): Same pattern found in 133 additional files. Review if needed.", "shortDescription": {"text": "[MINED052] Ts Any Typed (and 133 more): Same pattern found in 133 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-704 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED058", "name": "[MINED058] React Dangerously Set Html (and 7 more): Same pattern found in 7 additional files. Review if needed.", "shortDescription": {"text": "[MINED058] React Dangerously Set Html (and 7 more): Same pattern found in 7 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-79 / A03:2021 for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED056", "name": "[MINED056] React Key As Index (and 3 more): Same pattern found in 3 additional files. Review if needed.", "shortDescription": {"text": "[MINED056] React Key As Index (and 3 more): Same pattern found in 3 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-682 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "SEC040", "name": "[SEC040] innerHTML XSS \u2014 template literal with server-supplied data (and 20 more): Same pattern found in 20 additional f", "shortDescription": {"text": "[SEC040] innerHTML XSS \u2014 template literal with server-supplied data (and 20 more): Same pattern found in 20 additional files. Review if needed."}, "fullDescription": {"text": "For plain text: use el.textContent = data.value (auto-escapes).\nFor HTML you need to render: el.innerHTML = DOMPurify.sanitize(html).\nFor React/Vue/Svelte: stop using innerHTML; use the framework's binding.\nWhen data comes from CV/PDF parsers, sanitize at the parser boundary too."}, "properties": {"scanner": "repobility-threat-engine", "category": "xss", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED049", "name": "[MINED049] Print Pii: Logging password/token/email/ssn directly to stdout.", "shortDescription": {"text": "[MINED049] Print Pii: Logging password/token/email/ssn directly to stdout."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-532 / A09:2021 for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC020", "name": "[SEC020] Secret Printed to Logs (and 10 more): Same pattern found in 10 additional files. Review if needed.", "shortDescription": {"text": "[SEC020] Secret Printed to Logs (and 10 more): Same pattern found in 10 additional files. Review if needed."}, "fullDescription": {"text": "Log only redacted, hashed, or last-four-style metadata. Rotate any secret that may have reached logs."}, "properties": {"scanner": "repobility-threat-engine", "category": "credential_exposure", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "SEC085", "name": "[SEC085] JS: child_process.exec with non-literal (and 14 more): Same pattern found in 14 additional files. Review if nee", "shortDescription": {"text": "[SEC085] JS: child_process.exec with non-literal (and 14 more): Same pattern found in 14 additional files. Review if needed."}, "fullDescription": {"text": "Use execFile / spawn with separate args array; never pass shell strings."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "SEC083", "name": "[SEC083] JS: new RegExp() with non-literal (and 7 more): Same pattern found in 7 additional files. Review if needed.", "shortDescription": {"text": "[SEC083] JS: new RegExp() with non-literal (and 7 more): Same pattern found in 7 additional files. Review if needed."}, "fullDescription": {"text": "Use a literal RegExp or whitelist-validate user input before constructing patterns."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "SEC118", "name": "[SEC118] UUIDv1 / UUIDv3 used for security-sensitive identifier (and 1 more): Same pattern found in 1 additional files. ", "shortDescription": {"text": "[SEC118] UUIDv1 / UUIDv3 used for security-sensitive identifier (and 1 more): Same pattern found in 1 additional files. Review if needed."}, "fullDescription": {"text": "Use `uuid.uuid4()` (random) or `secrets.token_urlsafe()` for tokens. In Go, use `uuid.NewRandom()` (google/uuid)."}, "properties": {"scanner": "repobility-threat-engine", "category": "crypto", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED043", "name": "[MINED043] Http Not Https (and 6 more): Same pattern found in 6 additional files. Review if needed.", "shortDescription": {"text": "[MINED043] Http Not Https (and 6 more): Same pattern found in 6 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-319 / A02:2021 for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "SEC128", "name": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake) (and 75 more): Same pattern found in 75 add", "shortDescription": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake) (and 75 more): Same pattern found in 75 additional files. Review if needed."}, "fullDescription": {"text": "Add `await` before each async call, or chain with `.then`. If you intentionally want fire-and-forget, prefix with `void` (TS) or assign to `_` (Python with `asyncio.create_task`) to make the intent explicit and survive lint."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED045", "name": "[MINED045] Ts Non Null Assertion (and 68 more): Same pattern found in 68 additional files. Review if needed.", "shortDescription": {"text": "[MINED045] Ts Non Null Assertion (and 68 more): Same pattern found in 68 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-476 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED044", "name": "[MINED044] Js Console Log Prod (and 136 more): Same pattern found in 136 additional files. Review if needed.", "shortDescription": {"text": "[MINED044] Js Console Log Prod (and 136 more): Same pattern found in 136 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-532 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED067", "name": "[MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang forever.", "shortDescription": {"text": "[MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang forever."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-400 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC029", "name": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input (and 74 more): Same pattern found in 74 addi", "shortDescription": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input (and 74 more): Same pattern found in 74 additional files. Review if needed."}, "fullDescription": {"text": "Validate the URL against an allowlist BEFORE fetching:\n  ALLOWED = {'images.example.com', 'cdn.example.com'}\n  host = urlparse(url).hostname\n  if host not in ALLOWED: abort(400)\nOr use a server-side proxy (Imgproxy / serve-files-only-from-S3) that isolates outbound network access from the request handler.\nBlock private CIDRs explicitly: 10/8, 172.16/12, 192.168/16, 169.254/16."}, "properties": {"scanner": "repobility-threat-engine", "category": "ssrf", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED115", "name": "[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run t", "shortDescription": {"text": "[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) in"}, "fullDescription": {"text": "Replace with: `uses: actions/checkout@<40-char-sha>  # v4` and let Dependabot bump it on a scheduled cadence."}, "properties": {"scanner": "repobility-supply-chain", "category": "dependency", "severity": "high", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "MINED108", "name": "[MINED108] `self.assertIn` used but never assigned in __init__: Method `test_generate_comment` of class `TestCoverage` r", "shortDescription": {"text": "[MINED108] `self.assertIn` used but never assigned in __init__: Method `test_generate_comment` of class `TestCoverage` reads `self.assertIn`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeErr"}, "fullDescription": {"text": "Initialize `self.assertIn = <default>` in __init__, or add a class-level default."}, "properties": {"scanner": "repobility-ast-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED106", "name": "[MINED106] Phantom test coverage: test_set_github_output: Test function `test_set_github_output` runs code but contains ", "shortDescription": {"text": "[MINED106] Phantom test coverage: test_set_github_output: Test function `test_set_github_output` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "fullDescription": {"text": "Add an explicit assertion that captures the test's intent, or remove the test."}, "properties": {"scanner": "repobility-ast-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED004", "name": "[MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums).", "shortDescription": {"text": "[MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums)."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-327 / A02:2021 for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED031", "name": "[MINED031] React Direct State Mutation: this.state.X = Y mutates without setState. React wont re-render.", "shortDescription": {"text": "[MINED031] React Direct State Mutation: this.state.X = Y mutates without setState. React wont re-render."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-682 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED027", "name": "[MINED027] React State Array Mutation: state.X.push/splice/sort followed by setState \u2014 React skips re-render on mutated ", "shortDescription": {"text": "[MINED027] React State Array Mutation: state.X.push/splice/sort followed by setState \u2014 React skips re-render on mutated reference."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-682 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC080", "name": "[SEC080] Python: tarfile.extractall without filter: tarfile.extract*() without filter='data' allows path-traversal (CVE-", "shortDescription": {"text": "[SEC080] Python: tarfile.extractall without filter: tarfile.extract*() without filter='data' allows path-traversal (CVE-2007-4559, fixed via PEP 706 in 3.12). Ported from bandit B202 (Apache-2.0)."}, "fullDescription": {"text": "Add `filter='data'` (Python \u2265 3.12) or manually validate member paths against `os.path.abspath`."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC100", "name": "[SEC100] CORS permissive Access-Control-Allow-Origin: *: Permissive CORS policy (`*` origin) allows any website to make ", "shortDescription": {"text": "[SEC100] CORS permissive Access-Control-Allow-Origin: *: Permissive CORS policy (`*` origin) allows any website to make authenticated cross-origin requests. Especially dangerous when combined with `Access-Control-Allow-Credentials: true`."}, "fullDescription": {"text": "Allowlist specific origins. For dynamic per-request validation, validate against a known list and echo the origin back. Never combine wildcard origin with credentials."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC033", "name": "[SEC033] Prototype Pollution \u2014 unfiltered merge of user object: Merging user-controlled object into a target without fil", "shortDescription": {"text": "[SEC033] Prototype Pollution \u2014 unfiltered merge of user object: Merging user-controlled object into a target without filtering `__proto__`/`constructor`/`prototype` keys lets attackers inject properties onto Object.prototype, affecting ever"}, "fullDescription": {"text": "Sanitize keys BEFORE merge:\n  function sanitize(obj) {\n    delete obj.__proto__;\n    delete obj.constructor;\n    delete obj.prototype;\n    return obj;\n  }\nOr use Object.create(null) for the target. Or use Map() for user-key-indexed data. Upgrade lodash >= 4.17.21 for partial mitigation."}, "properties": {"scanner": "repobility-threat-engine", "category": "prototype_pollution", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED034", "name": "[MINED034] Python Subprocess Shell True: subprocess(..., shell=True) enables command injection.", "shortDescription": {"text": "[MINED034] Python Subprocess Shell True: subprocess(..., shell=True) enables command injection."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-78 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC078", "name": "[SEC078] Python: requests without timeout: requests.get/post without a timeout will hang indefinitely on a non-responsiv", "shortDescription": {"text": "[SEC078] Python: requests without timeout: requests.get/post without a timeout will hang indefinitely on a non-responsive server, causing thread exhaustion and ReDoS. Ported from bandit B113 (Apache-2.0). NOTE: this regex is heuristic; a re"}, "fullDescription": {"text": "Add `timeout=10` (or appropriate value) to every requests call."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC103", "name": "[SEC103] LDAP injection \u2014 non-constant search filter: User input concatenated into an LDAP search filter. Attackers inje", "shortDescription": {"text": "[SEC103] LDAP injection \u2014 non-constant search filter: User input concatenated into an LDAP search filter. Attackers inject `*)(uid=*` style payloads to bypass auth or enumerate accounts."}, "fullDescription": {"text": "Escape with javax.naming.ldap.Rdn.escapeValue or equivalent. For python-ldap, use ldap.filter.escape_filter_chars. Better: use parameterized search APIs (Spring LdapTemplate filter encoders)."}, "properties": {"scanner": "repobility-threat-engine", "category": "injection", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED132", "name": "[MINED132] Reverse shell idiom: bash interactive shell to /dev/tcp: File contains a known reverse-shell pattern (bash in", "shortDescription": {"text": "[MINED132] Reverse shell idiom: bash interactive shell to /dev/tcp: File contains a known reverse-shell pattern (bash interactive shell to /dev/tcp). These are almost never legitimate in production code \u2014 they're a hallmark of malicious pay"}, "fullDescription": {"text": "Remove the file or comment if it's documentation. If this is a security-testing repo, mark it with an inline `# nosec` comment and add the file to an allowlist."}, "properties": {"scanner": "repobility-supply-chain", "category": "dependency", "severity": "critical", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "MINED116", "name": "[MINED116] Workflow uses `secrets.QLTY_COVERAGE_TOKEN` on a `pull_request` trigger: This workflow triggers on `pull_requ", "shortDescription": {"text": "[MINED116] Workflow uses `secrets.QLTY_COVERAGE_TOKEN` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.QLTY_COVERAGE_TOKEN }` lets a PR from any fork exfiltrat"}, "fullDescription": {"text": "Either remove the secret reference, or switch the trigger to `pull_request_target` AND ensure no fork-controlled code runs before the secret is consumed."}, "properties": {"scanner": "repobility-supply-chain", "category": "dependency", "severity": "critical", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "MINED107", "name": "[MINED107] Missing import: `warnings` used but not imported: The file uses `warnings.something(...)` but never imports `", "shortDescription": {"text": "[MINED107] Missing import: `warnings` used but not imported: The file uses `warnings.something(...)` but never imports `warnings`. This raises NameError at runtime the first time the line executes."}, "fullDescription": {"text": "Add `import warnings` at the top of the file."}, "properties": {"scanner": "repobility-ast-engine", "category": "quality", "severity": "critical", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC084", "name": "[SEC084] JS: require() with non-literal: require(<variable>) loads arbitrary modules \u2014 equivalent to eval at module scop", "shortDescription": {"text": "[SEC084] JS: require() with non-literal: require(<variable>) loads arbitrary modules \u2014 equivalent to eval at module scope. Ported from eslint-plugin-security detect-non-literal-require (Apache-2.0)."}, "fullDescription": {"text": "Use static imports or a static mapping `const modules = { foo: require('./foo') }`."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "critical", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED018", "name": "[MINED018] Unsafe Deserialization Pickle: pickle.loads / yaml.load (without Loader=SafeLoader) / unmarshal of network/fi", "shortDescription": {"text": "[MINED018] Unsafe Deserialization Pickle: pickle.loads / yaml.load (without Loader=SafeLoader) / unmarshal of network/file data \u2014 RCE."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-502 / A08:2021 for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "critical", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC116", "name": "[SEC116] Ruby YAML.load / Marshal.load on untrusted input: `YAML.load` (pre-3.1) and `Marshal.load` instantiate arbitrar", "shortDescription": {"text": "[SEC116] Ruby YAML.load / Marshal.load on untrusted input: `YAML.load` (pre-3.1) and `Marshal.load` instantiate arbitrary Ruby classes \u2014 direct RCE on untrusted input. `unsafe_load` is even more dangerous."}, "fullDescription": {"text": "Use `YAML.safe_load(input, permitted_classes: [Date])` \u2014 explicit class allowlist. Never use `Marshal.load` on untrusted data; serialize as JSON instead."}, "properties": {"scanner": "repobility-threat-engine", "category": "deserialization", "severity": "critical", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC079", "name": "[SEC079] Python: yaml.load without SafeLoader: yaml.load() without explicit SafeLoader can execute arbitrary Python obje", "shortDescription": {"text": "[SEC079] Python: yaml.load without SafeLoader: yaml.load() without explicit SafeLoader can execute arbitrary Python objects (CVE-2017-18342). Ported from bandit B506 / dlint DUO109 (Apache-2.0 / BSD-3)."}, "fullDescription": {"text": "Use `yaml.safe_load(data)` or `yaml.load(data, Loader=yaml.SafeLoader)`."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "critical", "confidence": 1.0, "cwe": "", "owasp": ""}}]}}, "automationDetails": {"id": "repobility/868"}, "properties": {"repository": "cline/cline", "repoUrl": "https://github.com/cline/cline", "branch": "main"}, "results": [{"ruleId": "MINED111", "level": "warning", "message": {"text": "[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose."}, "properties": {"repobilityId": 79340, "scanner": "repobility-ast-engine", "fingerprint": "53377f1bdfa801266d2ced4307d7f1cc35ce80d92598477fa570c6012dbe34ad", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|53377f1bdfa801266d2ced4307d7f1cc35ce80d92598477fa570c6012dbe34ad"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sdk/examples/hooks/PostToolUse.py"}, "region": {"startLine": 23}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose."}, "properties": {"repobilityId": 79339, "scanner": "repobility-ast-engine", "fingerprint": "5f0f9309003fd170c6a4c3c1b49f3decf72c0cf7c40abbaeea350a777095b19f", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|5f0f9309003fd170c6a4c3c1b49f3decf72c0cf7c40abbaeea350a777095b19f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sdk/examples/hooks/PreToolUse_InjectContext.py"}, "region": {"startLine": 38}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose."}, "properties": {"repobilityId": 79338, "scanner": "repobility-ast-engine", "fingerprint": "f76f0df386f82d4001a8c81df99b83fef06d242344ee2cbb52df6e513b2e833f", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|f76f0df386f82d4001a8c81df99b83fef06d242344ee2cbb52df6e513b2e833f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sdk/examples/hooks/PreToolUse_InjectContext.py"}, "region": {"startLine": 25}}}]}, {"ruleId": "AGT013", "level": "warning", "message": {"text": "Agent auto-approve or skip-permissions mode is easy to enable"}, "properties": {"repobilityId": 79308, "scanner": "repobility-agent-runtime", "fingerprint": "95f6eb098f91c95c4eafeaddc2766d33d7935a553244c8508b6e1610f828fc45", "category": "quality", "severity": "medium", "confidence": 0.68, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "File exposes or configures a broad agent auto-approval mode without enough local guard wording.", "evidence": {"rule_id": "AGT013", "scanner": "repobility-agent-runtime", "references": [], "correlation_key": "fp|95f6eb098f91c95c4eafeaddc2766d33d7935a553244c8508b6e1610f828fc45"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/examples/cline-core-cli-agent/src/index.ts"}, "region": {"startLine": 140}}}]}, {"ruleId": "AGT007", "level": "warning", "message": {"text": "localStorage write failures are swallowed silently"}, "properties": {"repobilityId": 79307, "scanner": "repobility-agent-runtime", "fingerprint": "f3c96ecc988b6a64100791f38510824aeddbd9eb71bba91e799369062b41f572", "category": "quality", "severity": "medium", "confidence": 0.8, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "File writes to localStorage and has an empty or ignore-only catch block without QuotaExceededError handling.", "evidence": {"rule_id": "AGT007", "scanner": "repobility-agent-runtime", "references": ["https://developer.mozilla.org/en-US/docs/Web/API/Web_Storage_API"], "correlation_key": "fp|f3c96ecc988b6a64100791f38510824aeddbd9eb71bba91e799369062b41f572"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cline-hub/src/webview/src/vscode.ts"}, "region": {"startLine": 100}}}]}, {"ruleId": "AGT013", "level": "warning", "message": {"text": "Agent auto-approve or skip-permissions mode is easy to enable"}, "properties": {"repobilityId": 79306, "scanner": "repobility-agent-runtime", "fingerprint": "5c73d571dae0f5a501ec7e438b06aeb4b440e1164606dedb6d25fcd0efadc36f", "category": "quality", "severity": "medium", "confidence": 0.68, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "File exposes or configures a broad agent auto-approval mode without enough local guard wording.", "evidence": {"rule_id": "AGT013", "scanner": "repobility-agent-runtime", "references": [], "correlation_key": "fp|5c73d571dae0f5a501ec7e438b06aeb4b440e1164606dedb6d25fcd0efadc36f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cline-hub/src/server/sessions.ts"}, "region": {"startLine": 88}}}]}, {"ruleId": "AGT013", "level": "warning", "message": {"text": "Agent auto-approve or skip-permissions mode is easy to enable"}, "properties": {"repobilityId": 79305, "scanner": "repobility-agent-runtime", "fingerprint": "4ce329671671f7cf28243bc95ab09a1ff0e56c1433bee5e64b63cf9ed73ecbe7", "category": "quality", "severity": "medium", "confidence": 0.68, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "File exposes or configures a broad agent auto-approval mode without enough local guard wording.", "evidence": {"rule_id": "AGT013", "scanner": "repobility-agent-runtime", "references": [], "correlation_key": "fp|4ce329671671f7cf28243bc95ab09a1ff0e56c1433bee5e64b63cf9ed73ecbe7"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/runtime/tool-policies.ts"}, "region": {"startLine": 30}}}]}, {"ruleId": "AGT013", "level": "warning", "message": {"text": "Agent auto-approve or skip-permissions mode is easy to enable"}, "properties": {"repobilityId": 79304, "scanner": "repobility-agent-runtime", "fingerprint": "6d01146c3de54519b2a6c7fbd230cd633e1def4b4bf309beca3f1b1cca3fbc85", "category": "quality", "severity": "medium", "confidence": 0.68, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "File exposes or configures a broad agent auto-approval mode without enough local guard wording.", "evidence": {"rule_id": "AGT013", "scanner": "repobility-agent-runtime", "references": [], "correlation_key": "fp|6d01146c3de54519b2a6c7fbd230cd633e1def4b4bf309beca3f1b1cca3fbc85"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/main.ts"}, "region": {"startLine": 24}}}]}, {"ruleId": "AGT013", "level": "warning", "message": {"text": "Agent auto-approve or skip-permissions mode is easy to enable"}, "properties": {"repobilityId": 79303, "scanner": "repobility-agent-runtime", "fingerprint": "e5fb48376036c2f60d6e024de570b932a7cf4810793dd0959897f10f82b9e4f7", "category": "quality", "severity": "medium", "confidence": 0.68, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "File exposes or configures a broad agent auto-approval mode without enough local guard wording.", "evidence": {"rule_id": "AGT013", "scanner": "repobility-agent-runtime", "references": [], "correlation_key": "fp|e5fb48376036c2f60d6e024de570b932a7cf4810793dd0959897f10f82b9e4f7"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/commands/program.ts"}, "region": {"startLine": 11}}}]}, {"ruleId": "SEC134", "level": "warning", "message": {"text": "[SEC134] AI scaffold leftover \u2014 Lorem ipsum / example.com / John Doe in code: Lorem ipsum / John Doe / example.com left in non-test code. AI agents emit these as 'reasonable defaults' when they don't know real values; the human then forgets to swap them. In production, these break demo flows, send mail to a real example.com host (it's owned by IANA), and leak that the codebase had an AI scaffolding pass."}, "properties": {"repobilityId": 79266, "scanner": "repobility-threat-engine", "fingerprint": "900d5102a34fa3689024171ab380dd08871103d4a7fae5207d1fdf5e9481a33d", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "\"user@example.com\"", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC134", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|900d5102a34fa3689024171ab380dd08871103d4a7fae5207d1fdf5e9481a33d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sdk/packages/core/scripts/telemetry-smoke-host.ts"}, "region": {"startLine": 155}}}]}, {"ruleId": "SEC134", "level": "warning", "message": {"text": "[SEC134] AI scaffold leftover \u2014 Lorem ipsum / example.com / John Doe in code: Lorem ipsum / John Doe / example.com left in non-test code. AI agents emit these as 'reasonable defaults' when they don't know real values; the human then forgets to swap them. In production, these break demo flows, send mail to a real example.com host (it's owned by IANA), and leak that the codebase had an AI scaffolding pass."}, "properties": {"repobilityId": 79265, "scanner": "repobility-threat-engine", "fingerprint": "71c6c0d1b891336585bc88441c6bf6174ecd8e19bb3d3551e3248cd36d4b10d5", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "\"John Doe\"", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC134", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|71c6c0d1b891336585bc88441c6bf6174ecd8e19bb3d3551e3248cd36d4b10d5"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/webview-ui/src/components/ui/dialog.stories.tsx"}, "region": {"startLine": 181}}}]}, {"ruleId": "SEC134", "level": "warning", "message": {"text": "[SEC134] AI scaffold leftover \u2014 Lorem ipsum / example.com / John Doe in code: Lorem ipsum / John Doe / example.com left in non-test code. AI agents emit these as 'reasonable defaults' when they don't know real values; the human then forgets to swap them. In production, these break demo flows, send mail to a real example.com host (it's owned by IANA), and leak that the codebase had an AI scaffolding pass."}, "properties": {"repobilityId": 79264, "scanner": "repobility-threat-engine", "fingerprint": "c8a894abf2e0674208b37a72cf2e74d7ec8b4507e224b4bde7c2db1b93da3439", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "\"user@example.com\"", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC134", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|c8a894abf2e0674208b37a72cf2e74d7ec8b4507e224b4bde7c2db1b93da3439"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/webview-ui/src/components/chat/ErrorRow.stories.tsx"}, "region": {"startLine": 249}}}]}, {"ruleId": "SEC015", "level": "warning", "message": {"text": "[SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is predictable."}, "properties": {"repobilityId": 79258, "scanner": "repobility-threat-engine", "fingerprint": "46702387c7a473ae2da05061383876a5e75a419d71bafb728caf413029ca5502", "category": "crypto", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Security-sensitive keyword found nearby \u2014 weak PRNG is risky here", "evidence": {"match": "tokensIn: Math.floor(100 + Math.random", "reason": "Security-sensitive keyword found nearby \u2014 weak PRNG is risky here", "rule_id": "SEC015", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|crypto|token|125|sec015"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/dev/commands/tasks.ts"}, "region": {"startLine": 125}}}]}, {"ruleId": "SEC007", "level": "warning", "message": {"text": "[SEC007] Unsafe Deserialization: Unsafe deserialization can execute arbitrary code."}, "properties": {"repobilityId": 79245, "scanner": "repobility-threat-engine", "fingerprint": "966497513366ec3e86e7024e5701eb273a52f1d148c94ce37d9aada5a66fe378", "category": "deserialization", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "yaml.load(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC007", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|deserialization|token|46|sec007"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "evals/analysis/src/classifier.ts"}, "region": {"startLine": 46}}}]}, {"ruleId": "SEC007", "level": "warning", "message": {"text": "[SEC007] Unsafe Deserialization: Unsafe deserialization can execute arbitrary code."}, "properties": {"repobilityId": 79244, "scanner": "repobility-threat-engine", "fingerprint": "d05edba2e0ea77ecc68292a8770e1bb453c876b32c22e1a53e3b7c1003393f77", "category": "deserialization", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "yaml.load(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC007", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|deserialization|token|47|sec007"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/core/context/instructions/user-instructions/frontmatter.ts"}, "region": {"startLine": 47}}}]}, {"ruleId": "SEC136", "level": "warning", "message": {"text": "[SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all exception block that silently returns success or no-ops. AI agents reach for this pattern when a flaky test or an unfamiliar API throws \u2014 wrap, swallow, return success. Real bugs are masked, observability is destroyed, and callers think the operation worked. CWE-396 (improperly-generalized exception). Distinct from intentional fallback because there's no log line and the success value is fabricated."}, "properties": {"repobilityId": 79242, "scanner": "repobility-threat-engine", "fingerprint": "d14bd8644baa787ca312a93eed8eef86d2b8229153b28385e51b9db5699e74e4", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "} catch (_error) {\n\t\treturn null\n\t}", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC136", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|d14bd8644baa787ca312a93eed8eef86d2b8229153b28385e51b9db5699e74e4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/utils/git-worktree.ts"}, "region": {"startLine": 84}}}]}, {"ruleId": "SEC136", "level": "warning", "message": {"text": "[SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all exception block that silently returns success or no-ops. AI agents reach for this pattern when a flaky test or an unfamiliar API throws \u2014 wrap, swallow, return success. Real bugs are masked, observability is destroyed, and callers think the operation worked. CWE-396 (improperly-generalized exception). Distinct from intentional fallback because there's no log line and the success value is fabricated."}, "properties": {"repobilityId": 79241, "scanner": "repobility-threat-engine", "fingerprint": "e9586724330c7a98e344ad59f17cee2f339724bef5b52a80e84b6f7a62d02508", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "} catch (_error) {\n\t\treturn null\n\t}", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC136", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|e9586724330c7a98e344ad59f17cee2f339724bef5b52a80e84b6f7a62d02508"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/services/browser/BrowserDiscovery.ts"}, "region": {"startLine": 50}}}]}, {"ruleId": "SEC136", "level": "warning", "message": {"text": "[SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all exception block that silently returns success or no-ops. AI agents reach for this pattern when a flaky test or an unfamiliar API throws \u2014 wrap, swallow, return success. Real bugs are masked, observability is destroyed, and callers think the operation worked. CWE-396 (improperly-generalized exception). Distinct from intentional fallback because there's no log line and the success value is fabricated."}, "properties": {"repobilityId": 79240, "scanner": "repobility-threat-engine", "fingerprint": "26ca367dd4eaff05296e3a247d475aaf15c3340c3db5e6b4f70f57cf27fc9384", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "} catch (_err) {\n\t\t\treturn null\n\t\t}", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC136", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|26ca367dd4eaff05296e3a247d475aaf15c3340c3db5e6b4f70f57cf27fc9384"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/core/api/providers/claude-code.ts"}, "region": {"startLine": 212}}}]}, {"ruleId": "SEC017", "level": "warning", "message": {"text": "[SEC017] Unbounded Input to LLM/External API: User input is passed to an LLM or external AI API (OpenAI, Anthropic, etc.) without any visible length or size validation. This creates two risks: (1) Cost abuse \u2014 an attacker can send extremely long inputs to burn through your API credits (a single 128K-token request to GPT-4 costs ~$4, and automated attacks can drain budgets in minutes). (2) Context stuffing \u2014 oversized inputs can push your system prompt out of the context window, effectively disab"}, "properties": {"repobilityId": 79234, "scanner": "repobility-threat-engine", "fingerprint": "f8668c4afab9b619fa9080882660d4f68360706502338a311a8593815c7914b8", "category": "llm_injection", "severity": "medium", "confidence": 0.8, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "User input is passed to an AI/LLM API with no visible length check or rate limit. An attacker can send extremely long inputs to: (1) drain your API budget (128K tokens to GPT-4 \u2248 $4/request, automated = thousands of dollars), (2) push your system prompt out of the context window, disabling safety guardrails. Add input length validation before the API call.", "evidence": {"match": "client.chat.completions.create(request", "reason": "User input is passed to an AI/LLM API with no visible length check or rate limit. An attacker can send extremely long inputs to: (1) drain your API budget (128K tokens to GPT-4 \u2248 $4/request, automated = thousands of dollars), (2) push your system prompt out of the context window, disabling safety guardrails. Add input length validation before the API call.", "rule_id": "SEC017", "scanner": "repobility-threat-engine", "confidence": 0.8, "correlation_key": "fp|f8668c4afab9b619fa9080882660d4f68360706502338a311a8593815c7914b8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/core/api/transform/openrouter-stream.ts"}, "region": {"startLine": 214}}}]}, {"ruleId": "SEC017", "level": "warning", "message": {"text": "[SEC017] Unbounded Input to LLM/External API: User input is passed to an LLM or external AI API (OpenAI, Anthropic, etc.) without any visible length or size validation. This creates two risks: (1) Cost abuse \u2014 an attacker can send extremely long inputs to burn through your API credits (a single 128K-token request to GPT-4 costs ~$4, and automated attacks can drain budgets in minutes). (2) Context stuffing \u2014 oversized inputs can push your system prompt out of the context window, effectively disab"}, "properties": {"repobilityId": 79233, "scanner": "repobility-threat-engine", "fingerprint": "22c802c2485a870dbd7733379cf4516bb3f26c5639b8ebeb527c422a70a958d4", "category": "llm_injection", "severity": "medium", "confidence": 0.8, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "User input is passed to an AI/LLM API with no visible length check or rate limit. An attacker can send extremely long inputs to: (1) drain your API budget (128K tokens to GPT-4 \u2248 $4/request, automated = thousands of dollars), (2) push your system prompt out of the context window, disabling safety guardrails. Add input length validation before the API call.", "evidence": {"match": "client.chat.completions.create(request", "reason": "User input is passed to an AI/LLM API with no visible length check or rate limit. An attacker can send extremely long inputs to: (1) drain your API budget (128K tokens to GPT-4 \u2248 $4/request, automated = thousands of dollars), (2) push your system prompt out of the context window, disabling safety guardrails. Add input length validation before the API call.", "rule_id": "SEC017", "scanner": "repobility-threat-engine", "confidence": 0.8, "correlation_key": "fp|22c802c2485a870dbd7733379cf4516bb3f26c5639b8ebeb527c422a70a958d4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/core/api/providers/qwen-code.ts"}, "region": {"startLine": 207}}}]}, {"ruleId": "SEC017", "level": "warning", "message": {"text": "[SEC017] Unbounded Input to LLM/External API: User input is passed to an LLM or external AI API (OpenAI, Anthropic, etc.) without any visible length or size validation. This creates two risks: (1) Cost abuse \u2014 an attacker can send extremely long inputs to burn through your API credits (a single 128K-token request to GPT-4 costs ~$4, and automated attacks can drain budgets in minutes). (2) Context stuffing \u2014 oversized inputs can push your system prompt out of the context window, effectively disab"}, "properties": {"repobilityId": 79232, "scanner": "repobility-threat-engine", "fingerprint": "13a93e18ee764639198589fbd504bb4b033588d20e3e1856eded074f3b7df331", "category": "llm_injection", "severity": "medium", "confidence": 0.8, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "User input is passed to an AI/LLM API with no visible length check or rate limit. An attacker can send extremely long inputs to: (1) drain your API budget (128K tokens to GPT-4 \u2248 $4/request, automated = thousands of dollars), (2) push your system prompt out of the context window, disabling safety guardrails. Add input length validation before the API call.", "evidence": {"match": "client.chat.completions.create(fixedRequestBody", "reason": "User input is passed to an AI/LLM API with no visible length check or rate limit. An attacker can send extremely long inputs to: (1) drain your API budget (128K tokens to GPT-4 \u2248 $4/request, automated = thousands of dollars), (2) push your system prompt out of the context window, disabling safety guardrails. Add input length validation before the API call.", "rule_id": "SEC017", "scanner": "repobility-threat-engine", "confidence": 0.8, "correlation_key": "fp|13a93e18ee764639198589fbd504bb4b033588d20e3e1856eded074f3b7df331"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/core/api/providers/aihubmix.ts"}, "region": {"startLine": 263}}}]}, {"ruleId": "SEC087", "level": "warning", "message": {"text": "[SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces is predictable. Ported from gosec G404 / eslint detect-pseudoRandomBytes concept (Apache-2.0)."}, "properties": {"repobilityId": 79205, "scanner": "repobility-threat-engine", "fingerprint": "a939131341f5ff5999a7ea9457d7f35e7d00e41776b03fdfd9f3cfb1ecc50300", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "Math.random().toString(36).slice(2, 9)}`;\n}\n\nexport class ConversationStore {\n\tpriv", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC087", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|a939131341f5ff5999a7ea9457d7f35e7d00e41776b03fdfd9f3cfb1ecc50300"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sdk/packages/core/src/session/stores/conversation-store.ts"}, "region": {"startLine": 16}}}]}, {"ruleId": "SEC087", "level": "warning", "message": {"text": "[SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces is predictable. Ported from gosec G404 / eslint detect-pseudoRandomBytes concept (Apache-2.0)."}, "properties": {"repobilityId": 79204, "scanner": "repobility-threat-engine", "fingerprint": "2a3f3f5a28274cddbf146791b98a82bd3b3df0d561e72a24fc1efe4c74585848", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "Math.random() * 900), // Random token count from 100-1000\n\t\t\t\t\t\t\ttoken", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC087", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|2a3f3f5a28274cddbf146791b98a82bd3b3df0d561e72a24fc1efe4c74585848"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/dev/commands/tasks.ts"}, "region": {"startLine": 125}}}]}, {"ruleId": "SEC087", "level": "warning", "message": {"text": "[SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces is predictable. Ported from gosec G404 / eslint detect-pseudoRandomBytes concept (Apache-2.0)."}, "properties": {"repobilityId": 79203, "scanner": "repobility-threat-engine", "fingerprint": "1d222ad278a1eba87afc6a701c48342f1e98c982091c152b6fe8748bc452dc55", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "secret\" }, 401);\n\t\t\t\t}\n\t\t\t\tconst displayName = `Browser ${Math.random(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC087", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|1d222ad278a1eba87afc6a701c48342f1e98c982091c152b6fe8748bc452dc55"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cline-hub/src/server.ts"}, "region": {"startLine": 88}}}]}, {"ruleId": "SEC045", "level": "warning", "message": {"text": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use object introspection (().__class__.__mro__[-1].__subclasses__()) to reach os.system. CWE-95 (eval injection)."}, "properties": {"repobilityId": 79189, "scanner": "repobility-threat-engine", "fingerprint": "c7d6dcf7ac92c4d7ae0214e049bb80d392c51c28a914c8ef8f510e416ef9b588", "category": "injection", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": ".exec(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC045", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|injection|token|271|sec045"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/tui/utils/tool-parsing.ts"}, "region": {"startLine": 271}}}]}, {"ruleId": "SEC045", "level": "warning", "message": {"text": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use object introspection (().__class__.__mro__[-1].__subclasses__()) to reach os.system. CWE-95 (eval injection)."}, "properties": {"repobilityId": 79188, "scanner": "repobility-threat-engine", "fingerprint": "9c039a7b910be069567916df3033aad8258920ef658f42331dc2b346ce3a409f", "category": "injection", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": ".exec(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC045", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|injection|token|264|sec045"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/tui/commands/slash-command-registry.ts"}, "region": {"startLine": 264}}}]}, {"ruleId": "SEC045", "level": "warning", "message": {"text": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use object introspection (().__class__.__mro__[-1].__subclasses__()) to reach os.system. CWE-95 (eval injection)."}, "properties": {"repobilityId": 79187, "scanner": "repobility-threat-engine", "fingerprint": "ab9e7011a1363d2d64a0bedf8184a8434461bcb06bfd4e7af7f8b7dde0aae009", "category": "injection", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": ".exec(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC045", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|injection|token|77|sec045"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/runtime/prompt.ts"}, "region": {"startLine": 77}}}]}, {"ruleId": "ERR002", "level": "warning", "message": {"text": "[ERR002] Empty Catch Block: Empty catch blocks hide errors."}, "properties": {"repobilityId": 79181, "scanner": "repobility-threat-engine", "fingerprint": "8cc31778690ff839defa1bbb5dc0a5277eda38bf280728b5021b5dedaff68901", "category": "error_handling", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": ".catch(() => {})", "reason": "Pattern matched with no mitigating context found", "rule_id": "ERR002", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|8cc31778690ff839defa1bbb5dc0a5277eda38bf280728b5021b5dedaff68901"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/index.ts"}, "region": {"startLine": 53}}}]}, {"ruleId": "ERR002", "level": "warning", "message": {"text": "[ERR002] Empty Catch Block: Empty catch blocks hide errors."}, "properties": {"repobilityId": 79180, "scanner": "repobility-threat-engine", "fingerprint": "515c2162dffa203364c85d6dbfe600a04ab1dcf8cf1812e796fdc36ced7c07d6", "category": "error_handling", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": ".catch(() => {})", "reason": "Pattern matched with no mitigating context found", "rule_id": "ERR002", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|515c2162dffa203364c85d6dbfe600a04ab1dcf8cf1812e796fdc36ced7c07d6"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/connectors/runtime-turn.ts"}, "region": {"startLine": 337}}}]}, {"ruleId": "ERR002", "level": "warning", "message": {"text": "[ERR002] Empty Catch Block: Empty catch blocks hide errors."}, "properties": {"repobilityId": 79179, "scanner": "repobility-threat-engine", "fingerprint": "673ca5e0ef60910297a2cf675009d1d3e31f211a8c4ca734d8b5ae05a408b4a1", "category": "error_handling", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": ".catch(() => {})", "reason": "Pattern matched with no mitigating context found", "rule_id": "ERR002", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|673ca5e0ef60910297a2cf675009d1d3e31f211a8c4ca734d8b5ae05a408b4a1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/connectors/chat-runtime.ts"}, "region": {"startLine": 33}}}]}, {"ruleId": "SEC005", "level": "warning", "message": {"text": "[SEC005] Command Injection Risk: Unsafe shell execution or eval of user input."}, "properties": {"repobilityId": 79158, "scanner": "repobility-threat-engine", "fingerprint": "63859ff204828fe646da935a7467619a889e9e7cfbec86d6a457fd37e2ab54ff", "category": "injection", "severity": "medium", "confidence": 0.5, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "shell=True detected \u2014 verify command source is not user-controllable", "evidence": {"match": "exec(input", "reason": "shell=True detected \u2014 verify command source is not user-controllable", "rule_id": "SEC005", "scanner": "repobility-threat-engine", "confidence": 0.5, "correlation_key": "code|injection|token|14|sec005"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/utils/team-command.ts"}, "region": {"startLine": 14}}}]}, {"ruleId": "SEC005", "level": "warning", "message": {"text": "[SEC005] Command Injection Risk: Unsafe shell execution or eval of user input."}, "properties": {"repobilityId": 79157, "scanner": "repobility-threat-engine", "fingerprint": "05b2a30899c44a84ab7c0eae6483d82262fdb84df22d2df24e450b08a34bf88b", "category": "injection", "severity": "medium", "confidence": 0.5, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "shell=True detected \u2014 verify command source is not user-controllable", "evidence": {"match": "exec(input", "reason": "shell=True detected \u2014 verify command source is not user-controllable", "rule_id": "SEC005", "scanner": "repobility-threat-engine", "confidence": 0.5, "correlation_key": "code|injection|token|264|sec005"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/tui/commands/slash-command-registry.ts"}, "region": {"startLine": 264}}}]}, {"ruleId": "SEC005", "level": "warning", "message": {"text": "[SEC005] Command Injection Risk: Unsafe shell execution or eval of user input."}, "properties": {"repobilityId": 79156, "scanner": "repobility-threat-engine", "fingerprint": "a3a112eb3de54c1096c75ce3f179402573fb5d5b10334b284baa3bec034f75a8", "category": "injection", "severity": "medium", "confidence": 0.5, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "shell=True detected \u2014 verify command source is not user-controllable", "evidence": {"match": "subprocess.run(\n            cmd_list,\n            shell=False,  # Never use shell=True", "reason": "shell=True detected \u2014 verify command source is not user-controllable", "rule_id": "SEC005", "scanner": "repobility-threat-engine", "confidence": 0.5, "correlation_key": "code|injection|. token|190|sec005"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/coverage_check/util.py"}, "region": {"startLine": 190}}}]}, {"ruleId": "COMP001", "level": "warning", "message": {"text": "[COMP001] High cognitive complexity: Function `main` has cognitive complexity 21 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand \u2014 nested branches, boolean chains, and recursion all weigh in. Breakdown: elif=6, else=4, if=6, nested_bonus=5."}, "properties": {"repobilityId": 79145, "scanner": "repobility-threat-engine", "fingerprint": "2a12ffee98643405431f1a450015132de7545f268e04cfc4b2f91370ce8f5ba9", "category": "quality", "severity": "medium", "confidence": 0.95, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "AST-derived cognitive complexity score = 21 (severity threshold for medium: 15+).", "evidence": {"scanner": "repobility-threat-engine", "function": "main", "breakdown": {"if": 6, "elif": 6, "else": 4, "nested_bonus": 5}, "complexity": 21, "correlation_key": "fp|2a12ffee98643405431f1a450015132de7545f268e04cfc4b2f91370ce8f5ba9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/coverage_check/__main__.py"}, "region": {"startLine": 25}}}]}, {"ruleId": "WEB005", "level": "note", "message": {"text": "robots.txt does not advertise a sitemap"}, "properties": {"repobilityId": 79309, "scanner": "repobility-web-presence", "fingerprint": "2f3d78d93bd9ac04bf103367f4e385a6536393d626d585e514bcd9e8b6d9204c", "category": "quality", "severity": "low", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Discovered robots file or route lacks a Sitemap directive.", "evidence": {"rule_id": "WEB005", "scanner": "repobility-web-presence", "references": ["https://www.rfc-editor.org/rfc/rfc9309", "https://www.sitemaps.org/protocol.html"], "correlation_key": "fp|2f3d78d93bd9ac04bf103367f4e385a6536393d626d585e514bcd9e8b6d9204c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ext-jb-test-integration.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 79302, "scanner": "repobility-ai-code-hygiene", "fingerprint": "3786984f43d6e903a0dee8e1c9e9f684e42d3b60d1c6f8a9e46bb55e8d859f9c", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/vscode/src/core/api/providers/moonshot.ts", "duplicate_line": 52, "correlation_key": "fp|3786984f43d6e903a0dee8e1c9e9f684e42d3b60d1c6f8a9e46bb55e8d859f9c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/core/api/providers/nebius.ts"}, "region": {"startLine": 46}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 79301, "scanner": "repobility-ai-code-hygiene", "fingerprint": "fcc5d22702455e05d3af2e3b97a77e6bb44d17e492191d86f935ae9efdbbb8d5", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/vscode/src/core/api/providers/deepseek.ts", "duplicate_line": 80, "correlation_key": "fp|fcc5d22702455e05d3af2e3b97a77e6bb44d17e492191d86f935ae9efdbbb8d5"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/core/api/providers/moonshot.ts"}, "region": {"startLine": 54}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 79300, "scanner": "repobility-ai-code-hygiene", "fingerprint": "1ba828b9733e3971abfb039639a7d7c8036bee45acf1f4d5b32eb66adab99929", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/vscode/src/core/api/providers/anthropic.ts", "duplicate_line": 169, "correlation_key": "fp|1ba828b9733e3971abfb039639a7d7c8036bee45acf1f4d5b32eb66adab99929"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/core/api/providers/minimax.ts"}, "region": {"startLine": 78}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 79299, "scanner": "repobility-ai-code-hygiene", "fingerprint": "fece22cbae25b482568c872bf6a2ff9b36ae3e6a0c9af773f754d59f16027ae4", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/vscode/src/core/api/providers/hicap.ts", "duplicate_line": 64, "correlation_key": "fp|fece22cbae25b482568c872bf6a2ff9b36ae3e6a0c9af773f754d59f16027ae4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/core/api/providers/lmstudio.ts"}, "region": {"startLine": 55}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 79298, "scanner": "repobility-ai-code-hygiene", "fingerprint": "7e2019582f851826b700c3aae56faaad77dd877ff678acac95cab3c5508bc66c", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/vscode/src/core/api/providers/doubao.ts", "duplicate_line": 48, "correlation_key": "fp|7e2019582f851826b700c3aae56faaad77dd877ff678acac95cab3c5508bc66c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/core/api/providers/huawei-cloud-maas.ts"}, "region": {"startLine": 55}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 79297, "scanner": "repobility-ai-code-hygiene", "fingerprint": "62d0d3e67e075ab948bcf9270911ae26e1dcc39eac5db21d48484a818c1de862", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/vscode/src/core/api/providers/aihubmix.ts", "duplicate_line": 240, "correlation_key": "fp|62d0d3e67e075ab948bcf9270911ae26e1dcc39eac5db21d48484a818c1de862"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/core/api/providers/doubao.ts"}, "region": {"startLine": 63}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 79296, "scanner": "repobility-ai-code-hygiene", "fingerprint": "ebb52b4f0e0959471fef0694387d6a332a59314ecd73c49ba7c0c96e67a5e13d", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/cline-hub/src/webview/src/components/views/settings/channels-view.tsx", "duplicate_line": 3, "correlation_key": "fp|ebb52b4f0e0959471fef0694387d6a332a59314ecd73c49ba7c0c96e67a5e13d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cline-hub/src/webview/src/components/views/settings/mcp-view.tsx"}, "region": {"startLine": 3}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 79295, "scanner": "repobility-ai-code-hygiene", "fingerprint": "1b0757d7945e36afac244fe99cecf7f5c7fe1bc5882266437ac98e368728ef60", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/cli/src/wizards/connect/platforms.ts", "duplicate_line": 39, "correlation_key": "fp|1b0757d7945e36afac244fe99cecf7f5c7fe1bc5882266437ac98e368728ef60"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cline-hub/src/webview/src/components/views/settings/channels-view.tsx"}, "region": {"startLine": 142}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 79294, "scanner": "repobility-ai-code-hygiene", "fingerprint": "78f4c56928b7c7b8738cafe41c3a85f76ce30a00fedfb7f0bec17477a5f447a3", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/cli/src/connectors/status.ts", "duplicate_line": 16, "correlation_key": "fp|78f4c56928b7c7b8738cafe41c3a85f76ce30a00fedfb7f0bec17477a5f447a3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cline-hub/src/webview/src/components/views/settings/channels-view.tsx"}, "region": {"startLine": 70}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 79293, "scanner": "repobility-ai-code-hygiene", "fingerprint": "18484324058714859a498815ca4dc93349ce49b26d27ef045830367a0704791c", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/cline-hub/src/webview-protocol.ts", "duplicate_line": 117, "correlation_key": "fp|18484324058714859a498815ca4dc93349ce49b26d27ef045830367a0704791c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cline-hub/src/webview/src/components/views/settings/channels-view.tsx"}, "region": {"startLine": 38}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 79292, "scanner": "repobility-ai-code-hygiene", "fingerprint": "48f301a9409d2e3001adc3c75a61a8dac4164fb9d0ee21773798405471df6ef9", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/cline-hub/src/webview/src/components/ai-elements/model-selector.tsx", "duplicate_line": 2, "correlation_key": "fp|48f301a9409d2e3001adc3c75a61a8dac4164fb9d0ee21773798405471df6ef9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cline-hub/src/webview/src/components/ai-elements/voice-selector.tsx"}, "region": {"startLine": 17}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 79291, "scanner": "repobility-ai-code-hygiene", "fingerprint": "7e5c166440339a69448a8ff0e4b773738eb30658ef6e549a77294faa57bf9f56", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/cline-hub/src/webview/src/components/ai-elements/code-block.tsx", "duplicate_line": 389, "correlation_key": "fp|7e5c166440339a69448a8ff0e4b773738eb30658ef6e549a77294faa57bf9f56"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cline-hub/src/webview/src/components/ai-elements/snippet.tsx"}, "region": {"startLine": 87}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 79290, "scanner": "repobility-ai-code-hygiene", "fingerprint": "0d853b56e029f898f8e819fefaeacedc8f8d5e7a219dd3856ed6f3cf587ade71", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/cline-hub/src/webview/src/components/ai-elements/artifact.tsx", "duplicate_line": 106, "correlation_key": "fp|0d853b56e029f898f8e819fefaeacedc8f8d5e7a219dd3856ed6f3cf587ade71"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cline-hub/src/webview/src/components/ai-elements/message.tsx"}, "region": {"startLine": 84}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 79289, "scanner": "repobility-ai-code-hygiene", "fingerprint": "53c918949001f2e3263235741e952e4fd7bfa17ab45d5cca8a4b1dcc54a2a181", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/cli/src/connectors/status.ts", "duplicate_line": 16, "correlation_key": "fp|53c918949001f2e3263235741e952e4fd7bfa17ab45d5cca8a4b1dcc54a2a181"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cline-hub/src/webview-protocol.ts"}, "region": {"startLine": 149}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 79288, "scanner": "repobility-ai-code-hygiene", "fingerprint": "686adfff8f1bb75797aae25e5312b46b3bc2c60cd2bff775c7b8ff942a891c84", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/cli/src/wizards/mcp/index.ts", "duplicate_line": 436, "correlation_key": "fp|686adfff8f1bb75797aae25e5312b46b3bc2c60cd2bff775c7b8ff942a891c84"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/wizards/schedule/index.ts"}, "region": {"startLine": 425}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 79287, "scanner": "repobility-ai-code-hygiene", "fingerprint": "b60246562a6c496e6fc511d0df135580d5913865f2c60046ab779f76ecf159f3", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/cli/src/utils/chat-commands.ts", "duplicate_line": 156, "correlation_key": "fp|b60246562a6c496e6fc511d0df135580d5913865f2c60046ab779f76ecf159f3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/wizards/mcp/index.ts"}, "region": {"startLine": 63}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 79286, "scanner": "repobility-ai-code-hygiene", "fingerprint": "7772fa37d9e4cce43086977bffa62958012fa30d961c09f9dac8f2ea7564d762", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/cli/src/tui/components/dialogs/provider-picker.tsx", "duplicate_line": 289, "correlation_key": "fp|7772fa37d9e4cce43086977bffa62958012fa30d961c09f9dac8f2ea7564d762"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/tui/views/onboarding/screens.tsx"}, "region": {"startLine": 204}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 79285, "scanner": "repobility-ai-code-hygiene", "fingerprint": "393bf4ac9cc2fac8a3cae1e1c8d31f00cf7456474b65d219ad177dfd2ca97836", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/cli/src/tui/views/chat-view.tsx", "duplicate_line": 34, "correlation_key": "fp|393bf4ac9cc2fac8a3cae1e1c8d31f00cf7456474b65d219ad177dfd2ca97836"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/tui/views/home-view.tsx"}, "region": {"startLine": 29}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 79284, "scanner": "repobility-ai-code-hygiene", "fingerprint": "c21dd9115cdc1884870759abf90434855ac2cf79e0c2aa756587abb7700fc817", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/cli/src/tui/interactive-config.ts", "duplicate_line": 121, "correlation_key": "fp|c21dd9115cdc1884870759abf90434855ac2cf79e0c2aa756587abb7700fc817"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/tui/views/config-view.tsx"}, "region": {"startLine": 57}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 79283, "scanner": "repobility-ai-code-hygiene", "fingerprint": "2c42fa288e32e6c1947d6987b13f0b131f773d54bcc236a8a9c0f091cfab90dd", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/cli/src/tui/views/config-view-helpers.ts", "duplicate_line": 68, "correlation_key": "fp|2c42fa288e32e6c1947d6987b13f0b131f773d54bcc236a8a9c0f091cfab90dd"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/tui/views/config-view.tsx"}, "region": {"startLine": 56}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 79282, "scanner": "repobility-ai-code-hygiene", "fingerprint": "a7f92295200cdf7a6b4a5ee8fd68ba419c81f31c2fc3c646ad637bcc50f38c88", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/cli/src/tui/interactive-config.ts", "duplicate_line": 121, "correlation_key": "fp|a7f92295200cdf7a6b4a5ee8fd68ba419c81f31c2fc3c646ad637bcc50f38c88"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/tui/views/config-view-helpers.ts"}, "region": {"startLine": 69}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 79281, "scanner": "repobility-ai-code-hygiene", "fingerprint": "e68f713d89bb8f3251fd0afb71ca48a9bd59b0a6b87dc8941a37a89299d2a3bf", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/cli/src/commands/config.ts", "duplicate_line": 188, "correlation_key": "fp|e68f713d89bb8f3251fd0afb71ca48a9bd59b0a6b87dc8941a37a89299d2a3bf"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/tui/interactive-config.ts"}, "region": {"startLine": 168}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 79280, "scanner": "repobility-ai-code-hygiene", "fingerprint": "7d36c47cadcd2c9cea302bfb69c289012a9f0f7d802785ba3a584d361e921295", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/cli/src/tui/components/dialogs/provider-picker.tsx", "duplicate_line": 138, "correlation_key": "fp|7d36c47cadcd2c9cea302bfb69c289012a9f0f7d802785ba3a584d361e921295"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/tui/components/searchable-list.tsx"}, "region": {"startLine": 241}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 79279, "scanner": "repobility-ai-code-hygiene", "fingerprint": "9c7b51c04af5993b8cf95addfd9183a5bb37f706315357a072bbd6d820d3960a", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/cli/src/tui/components/model-selector/cline-model-picker.tsx", "duplicate_line": 21, "correlation_key": "fp|9c7b51c04af5993b8cf95addfd9183a5bb37f706315357a072bbd6d820d3960a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/tui/components/model-selector/cline-model-selector.tsx"}, "region": {"startLine": 13}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 79278, "scanner": "repobility-ai-code-hygiene", "fingerprint": "9f99f123c3dac399e7ee1f156fee0d573ecb16411c84ae4d05c2eccff86ea49f", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/cli/src/connectors/stores/file-state.ts", "duplicate_line": 195, "correlation_key": "fp|9f99f123c3dac399e7ee1f156fee0d573ecb16411c84ae4d05c2eccff86ea49f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/connectors/stores/memory-state.ts"}, "region": {"startLine": 84}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 79277, "scanner": "repobility-ai-code-hygiene", "fingerprint": "836dafe03f9e7da3c4c44142081465e5ad461c6632b165c72b925138ab962896", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/cli/src/connectors/adapters/linear.ts", "duplicate_line": 295, "correlation_key": "fp|836dafe03f9e7da3c4c44142081465e5ad461c6632b165c72b925138ab962896"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/connectors/adapters/whatsapp.ts"}, "region": {"startLine": 278}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 79276, "scanner": "repobility-ai-code-hygiene", "fingerprint": "100770dbc38cd3554597de10e90a450201bf23ce42aaa8954d9c636c996d96fe", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/cli/src/connectors/adapters/gchat.ts", "duplicate_line": 14, "correlation_key": "fp|100770dbc38cd3554597de10e90a450201bf23ce42aaa8954d9c636c996d96fe"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/connectors/adapters/whatsapp.ts"}, "region": {"startLine": 14}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 79275, "scanner": "repobility-ai-code-hygiene", "fingerprint": "58832d8de555bd5bb4113cccab153ab3451b838e75695a04fe2cc14447c9d575", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/cli/src/connectors/adapters/gchat.ts", "duplicate_line": 14, "correlation_key": "fp|58832d8de555bd5bb4113cccab153ab3451b838e75695a04fe2cc14447c9d575"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/connectors/adapters/linear.ts"}, "region": {"startLine": 10}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 79274, "scanner": "repobility-ai-code-hygiene", "fingerprint": "7f0d3aa94a474e47b1e39d81c1c15cc0ab8599fb44b3939fa5f15da08f51c6b0", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/cli/src/commands/schedule/handlers.ts", "duplicate_line": 156, "correlation_key": "fp|7f0d3aa94a474e47b1e39d81c1c15cc0ab8599fb44b3939fa5f15da08f51c6b0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/commands/schedule/import-export.ts"}, "region": {"startLine": 60}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 79273, "scanner": "repobility-ai-code-hygiene", "fingerprint": "8a7e7190aeae763c11bf233338643f9d5a3c291d0aed51956052c717e97bae13", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/cli/src/commands/doctor.ts", "duplicate_line": 258, "correlation_key": "fp|8a7e7190aeae763c11bf233338643f9d5a3c291d0aed51956052c717e97bae13"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/commands/hub.ts"}, "region": {"startLine": 31}}}]}, {"ruleId": "AIC002", "level": "note", "message": {"text": "Source file name looks like an AI patch artifact"}, "properties": {"repobilityId": 79272, "scanner": "repobility-ai-code-hygiene", "fingerprint": "5cea6112ed33c12c27014b7fc45b7e1d893ad7af36d607c481b6c9fed1aa7f54", "category": "quality", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Source filename contains a temporary or patch-style suffix.", "evidence": {"suffix": "copy", "rule_id": "AIC002", "scanner": "repobility-ai-code-hygiene", "references": ["https://arxiv.org/abs/2601.15195"], "correlation_key": "fp|5cea6112ed33c12c27014b7fc45b7e1d893ad7af36d607c481b6c9fed1aa7f54"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/tui/utils/selection-copy.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "SEC006", "level": "note", "message": {"text": "[SEC006] XSS Risk: Direct HTML injection without sanitization."}, "properties": {"repobilityId": 79267, "scanner": "repobility-threat-engine", "fingerprint": "19e24862ab4b4080cde8b6731debe1d5df88a6274555a2a8d49e7170b555ff5d", "category": "injection", "severity": "low", "confidence": 0.4, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "No user-input source (request/query/fetch/URL) found \u2014 may be static content", "evidence": {"match": ".innerHTML = s", "reason": "No user-input source (request/query/fetch/URL) found \u2014 may be static content", "rule_id": "SEC006", "scanner": "repobility-threat-engine", "confidence": 0.4, "correlation_key": "code|injection|token|109|sec006"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/webview-ui/src/components/common/MermaidBlock.tsx"}, "region": {"startLine": 109}}}]}, {"ruleId": "COMP001", "level": "note", "message": {"text": "[COMP001] High cognitive complexity: Function `print_debug_output` has cognitive complexity 9 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand \u2014 nested branches, boolean chains, and recursion all weigh in. Breakdown: else=3, if=4, nested_bonus=2."}, "properties": {"repobilityId": 79147, "scanner": "repobility-threat-engine", "fingerprint": "6222080b0931330d2764586401266a465a84547d66fe52893f743226272c912b", "category": "quality", "severity": "low", "confidence": 0.95, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "AST-derived cognitive complexity score = 9 (severity threshold for low: 8+).", "evidence": {"scanner": "repobility-threat-engine", "function": "print_debug_output", "breakdown": {"if": 4, "else": 3, "nested_bonus": 2}, "complexity": 9, "correlation_key": "fp|6222080b0931330d2764586401266a465a84547d66fe52893f743226272c912b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/coverage_check/extraction.py"}, "region": {"startLine": 22}}}]}, {"ruleId": "MINED042", "level": "none", "message": {"text": "[MINED042] Cpp New Without Delete: C++ raw new without RAII / unique_ptr \u2014 memory leak risk."}, "properties": {"repobilityId": 79270, "scanner": "repobility-threat-engine", "fingerprint": "136e849a3d71e123723d865a3a50187f6010092f26f67f36a0fbb36456e00518", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "cpp-new-without-delete", "owasp": null, "cwe_ids": ["CWE-401"], "languages": ["cpp"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347996+00:00", "triaged_in_corpus": 12, "observations_count": 4658256, "ai_coder_pattern_id": 134}, "scanner": "repobility-threat-engine", "correlation_key": "fp|136e849a3d71e123723d865a3a50187f6010092f26f67f36a0fbb36456e00518"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sdk/packages/shared/bun.mts"}, "region": {"startLine": 22}}}]}, {"ruleId": "MINED042", "level": "none", "message": {"text": "[MINED042] Cpp New Without Delete: C++ raw new without RAII / unique_ptr \u2014 memory leak risk."}, "properties": {"repobilityId": 79269, "scanner": "repobility-threat-engine", "fingerprint": "0cc4b80789395828a5b6cf1636c79efedf801f0df6a73dccb6027fb5dd77aa30", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "cpp-new-without-delete", "owasp": null, "cwe_ids": ["CWE-401"], "languages": ["cpp"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347996+00:00", "triaged_in_corpus": 12, "observations_count": 4658256, "ai_coder_pattern_id": 134}, "scanner": "repobility-threat-engine", "correlation_key": "fp|0cc4b80789395828a5b6cf1636c79efedf801f0df6a73dccb6027fb5dd77aa30"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sdk/packages/llms/bun.mts"}, "region": {"startLine": 10}}}]}, {"ruleId": "MINED042", "level": "none", "message": {"text": "[MINED042] Cpp New Without Delete: C++ raw new without RAII / unique_ptr \u2014 memory leak risk."}, "properties": {"repobilityId": 79268, "scanner": "repobility-threat-engine", "fingerprint": "b521cdc032f41342571113f5486d7c5f2d0868ee577c4f2a365af3c9055c1748", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "cpp-new-without-delete", "owasp": null, "cwe_ids": ["CWE-401"], "languages": ["cpp"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347996+00:00", "triaged_in_corpus": 12, "observations_count": 4658256, "ai_coder_pattern_id": 134}, "scanner": "repobility-threat-engine", "correlation_key": "fp|b521cdc032f41342571113f5486d7c5f2d0868ee577c4f2a365af3c9055c1748"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sdk/packages/core/bun.mts"}, "region": {"startLine": 10}}}]}, {"ruleId": "MINED057", "level": "none", "message": {"text": "[MINED057] Todo Bomb: Code path with a TODO/FIXME/HACK comment that gates correctness \u2014 left for later but never resolved."}, "properties": {"repobilityId": 79261, "scanner": "repobility-threat-engine", "fingerprint": "7194e2b39858d0d728e0370a37c6fa51e9c2be02a07503bacaeb247935cd0e68", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "todo-bomb", "owasp": null, "cwe_ids": [], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348035+00:00", "triaged_in_corpus": 10, "observations_count": 255662, "ai_coder_pattern_id": 4}, "scanner": "repobility-threat-engine", "correlation_key": "fp|7194e2b39858d0d728e0370a37c6fa51e9c2be02a07503bacaeb247935cd0e68"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/shared/Patch.ts"}, "region": {"startLine": 25}}}]}, {"ruleId": "MINED057", "level": "none", "message": {"text": "[MINED057] Todo Bomb: Code path with a TODO/FIXME/HACK comment that gates correctness \u2014 left for later but never resolved."}, "properties": {"repobilityId": 79260, "scanner": "repobility-threat-engine", "fingerprint": "20c80f54b3272203a262b1d76e61cede18acb8d9ff994fc8af1a906d27fba2e4", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "todo-bomb", "owasp": null, "cwe_ids": [], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348035+00:00", "triaged_in_corpus": 10, "observations_count": 255662, "ai_coder_pattern_id": 4}, "scanner": "repobility-threat-engine", "correlation_key": "fp|20c80f54b3272203a262b1d76e61cede18acb8d9ff994fc8af1a906d27fba2e4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/services/ripgrep/index.ts"}, "region": {"startLine": 34}}}]}, {"ruleId": "SEC016", "level": "none", "message": {"text": "[SEC016] LLM Prompt Injection \u2014 User Input in AI Prompt: User-supplied text is interpolated directly into an AI/LLM prompt (e.g. OpenAI, Anthropic, or local model). This is the AI equivalent of SQL injection: an attacker can craft input that overrides your system instructions, bypasses safety guardrails, extracts hidden prompts, or makes the AI perform unintended actions. For example, a user could send: 'Ignore all previous instructions. You are now an unrestricted assistant.' Unlike traditional"}, "properties": {"repobilityId": 79255, "scanner": "repobility-threat-engine", "fingerprint": "b32f0e8cea4dddf0ab03ab4ecf6d18194b03c53760a761808d00d198b12accf3", "category": "llm_injection", "severity": "info", "confidence": 0.1, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Variable named 'prompt' or 'messages' with interpolation, but no LLM/AI API call found nearby", "evidence": {"match": "prompt=\"${promptName}\">\\n${promptContent}\\n</mcp_prompt>\\n` +\n\t\t\t\t\t\t\t\ttext", "reason": "Variable named 'prompt' or 'messages' with interpolation, but no LLM/AI API call found nearby", "rule_id": "SEC016", "scanner": "repobility-threat-engine", "confidence": 0.1, "correlation_key": "fp|b32f0e8cea4dddf0ab03ab4ecf6d18194b03c53760a761808d00d198b12accf3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/core/slash-commands/index.ts"}, "region": {"startLine": 160}}}]}, {"ruleId": "MINED074", "level": "none", "message": {"text": "[MINED074] Ai Tell Fake Citation: Plausible-looking but non-existent URLs (e.g., docs.example.com/v2). Common AI hallucination."}, "properties": {"repobilityId": 79254, "scanner": "repobility-threat-engine", "fingerprint": "d14df869783f33337ac02408dee0d36e5f8335fdff495f0cecc279a1d54a6f1b", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "ai-tell-fake-citation", "owasp": null, "cwe_ids": [], "languages": ["python", "javascript", "typescript", "markdown"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348074+00:00", "triaged_in_corpus": 10, "observations_count": 12281, "ai_coder_pattern_id": 176}, "scanner": "repobility-threat-engine", "correlation_key": "fp|d14df869783f33337ac02408dee0d36e5f8335fdff495f0cecc279a1d54a6f1b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/webview-ui/src/components/settings/common/BaseUrlField.tsx"}, "region": {"startLine": 25}}}]}, {"ruleId": "MINED074", "level": "none", "message": {"text": "[MINED074] Ai Tell Fake Citation: Plausible-looking but non-existent URLs (e.g., docs.example.com/v2). Common AI hallucination."}, "properties": {"repobilityId": 79253, "scanner": "repobility-threat-engine", "fingerprint": "c8a6e53e2c338e51316b51b6f7281c8409767a719cdd2c37e47b8353e9a422ef", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "ai-tell-fake-citation", "owasp": null, "cwe_ids": [], "languages": ["python", "javascript", "typescript", "markdown"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348074+00:00", "triaged_in_corpus": 10, "observations_count": 12281, "ai_coder_pattern_id": 176}, "scanner": "repobility-threat-engine", "correlation_key": "fp|c8a6e53e2c338e51316b51b6f7281c8409767a719cdd2c37e47b8353e9a422ef"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/webview-ui/src/components/mcp/chat-display/McpResponseDisplay.stories.tsx"}, "region": {"startLine": 36}}}]}, {"ruleId": "MINED074", "level": "none", "message": {"text": "[MINED074] Ai Tell Fake Citation: Plausible-looking but non-existent URLs (e.g., docs.example.com/v2). Common AI hallucination."}, "properties": {"repobilityId": 79252, "scanner": "repobility-threat-engine", "fingerprint": "0a424a7a316a05ccb76125ebe3ecba61335f7d094a499c7f3a9b1c4a30e91eb6", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "ai-tell-fake-citation", "owasp": null, "cwe_ids": [], "languages": ["python", "javascript", "typescript", "markdown"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348074+00:00", "triaged_in_corpus": 10, "observations_count": 12281, "ai_coder_pattern_id": 176}, "scanner": "repobility-threat-engine", "correlation_key": "fp|0a424a7a316a05ccb76125ebe3ecba61335f7d094a499c7f3a9b1c4a30e91eb6"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/core/prompts/system-prompt/components/tool_use/examples.ts"}, "region": {"startLine": 43}}}]}, {"ruleId": "SEC136", "level": "none", "message": {"text": "[SEC136] AI-typical over-broad exception handler swallowing all errors (and 2 more): Same pattern found in 2 additional files. Review if needed."}, "properties": {"repobilityId": 79243, "scanner": "repobility-threat-engine", "fingerprint": "177c770515f587906108b42e96cd3338ec47ddf67f686d5997cc1b924f1a1bdf", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 2 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 2 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC136", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|177c770515f587906108b42e96cd3338ec47ddf67f686d5997cc1b924f1a1bdf"}}}, {"ruleId": "MINED054", "level": "none", "message": {"text": "[MINED054] Ts As Any (and 49 more): Same pattern found in 49 additional files. Review if needed."}, "properties": {"repobilityId": 79239, "scanner": "repobility-threat-engine", "fingerprint": "ff2abf75d1e921281e3747c5387bd3d81dab012c76c5e093913bc92ebbefc6bc", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 49 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "ts-as-any", "owasp": null, "cwe_ids": ["CWE-704"], "languages": ["typescript", "tsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348028+00:00", "triaged_in_corpus": 12, "observations_count": 341218, "ai_coder_pattern_id": 98}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|ff2abf75d1e921281e3747c5387bd3d81dab012c76c5e093913bc92ebbefc6bc", "aggregated_count": 49}}}, {"ruleId": "MINED054", "level": "none", "message": {"text": "[MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely."}, "properties": {"repobilityId": 79238, "scanner": "repobility-threat-engine", "fingerprint": "74e82e47ceb1eb1d9287288b346fa496aa9496c7f59687ed705345f21217f852", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "ts-as-any", "owasp": null, "cwe_ids": ["CWE-704"], "languages": ["typescript", "tsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348028+00:00", "triaged_in_corpus": 12, "observations_count": 341218, "ai_coder_pattern_id": 98}, "scanner": "repobility-threat-engine", "correlation_key": "fp|74e82e47ceb1eb1d9287288b346fa496aa9496c7f59687ed705345f21217f852"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/core/api/providers/baseten.ts"}, "region": {"startLine": 166}}}]}, {"ruleId": "MINED054", "level": "none", "message": {"text": "[MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely."}, "properties": {"repobilityId": 79237, "scanner": "repobility-threat-engine", "fingerprint": "b6ab83c16eab7f42652925a91f696d613fddf75eb0471df7ed5deca94ca36a0c", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "ts-as-any", "owasp": null, "cwe_ids": ["CWE-704"], "languages": ["typescript", "tsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348028+00:00", "triaged_in_corpus": 12, "observations_count": 341218, "ai_coder_pattern_id": 98}, "scanner": "repobility-threat-engine", "correlation_key": "fp|b6ab83c16eab7f42652925a91f696d613fddf75eb0471df7ed5deca94ca36a0c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/core/api/providers/anthropic.ts"}, "region": {"startLine": 109}}}]}, {"ruleId": "MINED054", "level": "none", "message": {"text": "[MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely."}, "properties": {"repobilityId": 79236, "scanner": "repobility-threat-engine", "fingerprint": "ca54afdfc078d6b6026e82beb37edeb80d73bc26afc8591e6b8e8061f75fcef6", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "ts-as-any", "owasp": null, "cwe_ids": ["CWE-704"], "languages": ["typescript", "tsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348028+00:00", "triaged_in_corpus": 12, "observations_count": 341218, "ai_coder_pattern_id": 98}, "scanner": "repobility-threat-engine", "correlation_key": "fp|ca54afdfc078d6b6026e82beb37edeb80d73bc26afc8591e6b8e8061f75fcef6"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/core/api/providers/aihubmix.ts"}, "region": {"startLine": 222}}}]}, {"ruleId": "SEC017", "level": "none", "message": {"text": "[SEC017] Unbounded Input to LLM/External API (and 3 more): Same pattern found in 3 additional files. Review if needed."}, "properties": {"repobilityId": 79235, "scanner": "repobility-threat-engine", "fingerprint": "090f87163849a9f71551dea6dc62a5a74a7ec0e85eb5f58179d0a7315503fef4", "category": "llm_injection", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 3 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 3 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC017", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|090f87163849a9f71551dea6dc62a5a74a7ec0e85eb5f58179d0a7315503fef4"}}}, {"ruleId": "SEC114", "level": "none", "message": {"text": "[SEC114] path.join / Path() on user-controlled segment without containment check (and 3 more): Same pattern found in 3 additional files. Review if needed."}, "properties": {"repobilityId": 79231, "scanner": "repobility-threat-engine", "fingerprint": "24f4624d0de920ee81a058388763b66a99b20d4d0144f10b5e9e0d4729fc87e4", "category": "path_traversal", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 3 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 3 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC114", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|24f4624d0de920ee81a058388763b66a99b20d4d0144f10b5e9e0d4729fc87e4"}}}, {"ruleId": "MINED052", "level": "none", "message": {"text": "[MINED052] Ts Any Typed (and 133 more): Same pattern found in 133 additional files. Review if needed."}, "properties": {"repobilityId": 79227, "scanner": "repobility-threat-engine", "fingerprint": "16a66cda908ccff52dbaae8cbaaec558ee05457610cdf7eaf40baf44a8124875", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 133 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "ts-any-typed", "owasp": null, "cwe_ids": ["CWE-704"], "languages": ["typescript", "tsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348022+00:00", "triaged_in_corpus": 12, "observations_count": 496002, "ai_coder_pattern_id": 97}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|16a66cda908ccff52dbaae8cbaaec558ee05457610cdf7eaf40baf44a8124875", "aggregated_count": 133}}}, {"ruleId": "MINED052", "level": "none", "message": {"text": "[MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety."}, "properties": {"repobilityId": 79226, "scanner": "repobility-threat-engine", "fingerprint": "098cb165b6c6f17651cb54902e62604b562677ca58d0d38b3027e8d176a96fa9", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "ts-any-typed", "owasp": null, "cwe_ids": ["CWE-704"], "languages": ["typescript", "tsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348022+00:00", "triaged_in_corpus": 12, "observations_count": 496002, "ai_coder_pattern_id": 97}, "scanner": "repobility-threat-engine", "correlation_key": "fp|098cb165b6c6f17651cb54902e62604b562677ca58d0d38b3027e8d176a96fa9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/core/api/providers/asksage.ts"}, "region": {"startLine": 49}}}]}, {"ruleId": "MINED052", "level": "none", "message": {"text": "[MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety."}, "properties": {"repobilityId": 79225, "scanner": "repobility-threat-engine", "fingerprint": "e50e18e936568f7f30fad551d18379b70b552d39a74693335b3e077f4472de5e", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "ts-any-typed", "owasp": null, "cwe_ids": ["CWE-704"], "languages": ["typescript", "tsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348022+00:00", "triaged_in_corpus": 12, "observations_count": 496002, "ai_coder_pattern_id": 97}, "scanner": "repobility-threat-engine", "correlation_key": "fp|e50e18e936568f7f30fad551d18379b70b552d39a74693335b3e077f4472de5e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/core/api/providers/aihubmix.ts"}, "region": {"startLine": 118}}}]}, {"ruleId": "MINED052", "level": "none", "message": {"text": "[MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety."}, "properties": {"repobilityId": 79224, "scanner": "repobility-threat-engine", "fingerprint": "215ad4e4b3b2834052562c6966b01511c3e49551c4cede39c57d594d5cbc4170", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "ts-any-typed", "owasp": null, "cwe_ids": ["CWE-704"], "languages": ["typescript", "tsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348022+00:00", "triaged_in_corpus": 12, "observations_count": 496002, "ai_coder_pattern_id": 97}, "scanner": "repobility-threat-engine", "correlation_key": "fp|215ad4e4b3b2834052562c6966b01511c3e49551c4cede39c57d594d5cbc4170"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/scripts/test-hostbridge-server.ts"}, "region": {"startLine": 59}}}]}, {"ruleId": "MINED058", "level": "none", "message": {"text": "[MINED058] React Dangerously Set Html (and 7 more): Same pattern found in 7 additional files. Review if needed."}, "properties": {"repobilityId": 79220, "scanner": "repobility-threat-engine", "fingerprint": "dd55ce3a9f3f9694552e8f4756890f4a32ddb6947f938d3ce6625eb2c930cc47", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 7 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "react-dangerously-set-html", "owasp": "A03:2021", "cwe_ids": ["CWE-79"], "languages": ["javascript", "typescript"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348037+00:00", "triaged_in_corpus": 12, "observations_count": 255650, "ai_coder_pattern_id": 49}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|dd55ce3a9f3f9694552e8f4756890f4a32ddb6947f938d3ce6625eb2c930cc47", "aggregated_count": 7}}}, {"ruleId": "MINED058", "level": "none", "message": {"text": "[MINED058] React Dangerously Set Html: dangerouslySetInnerHTML bypasses Reacts JSX escaping. Pair with DOMPurify or never use with user data."}, "properties": {"repobilityId": 79219, "scanner": "repobility-threat-engine", "fingerprint": "003a9cdce013e7ab3d3e79357d2a0243d115cc0bd3e3f9f25cc4b76c6b1faf34", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "react-dangerously-set-html", "owasp": "A03:2021", "cwe_ids": ["CWE-79"], "languages": ["javascript", "typescript"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348037+00:00", "triaged_in_corpus": 12, "observations_count": 255650, "ai_coder_pattern_id": 49}, "scanner": "repobility-threat-engine", "correlation_key": "fp|003a9cdce013e7ab3d3e79357d2a0243d115cc0bd3e3f9f25cc4b76c6b1faf34"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/webview-ui/src/components/settings/GroqModelPicker.tsx"}, "region": {"startLine": 240}}}]}, {"ruleId": "MINED058", "level": "none", "message": {"text": "[MINED058] React Dangerously Set Html: dangerouslySetInnerHTML bypasses Reacts JSX escaping. Pair with DOMPurify or never use with user data."}, "properties": {"repobilityId": 79218, "scanner": "repobility-threat-engine", "fingerprint": "d15cdaed44c2376111d5dbfa455f15713a7e516d8c33a599ebcf89f197e2f123", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "react-dangerously-set-html", "owasp": "A03:2021", "cwe_ids": ["CWE-79"], "languages": ["javascript", "typescript"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348037+00:00", "triaged_in_corpus": 12, "observations_count": 255650, "ai_coder_pattern_id": 49}, "scanner": "repobility-threat-engine", "correlation_key": "fp|d15cdaed44c2376111d5dbfa455f15713a7e516d8c33a599ebcf89f197e2f123"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/examples/vscode/src/webview/src/components/ui/chart.tsx"}, "region": {"startLine": 82}}}]}, {"ruleId": "MINED058", "level": "none", "message": {"text": "[MINED058] React Dangerously Set Html: dangerouslySetInnerHTML bypasses Reacts JSX escaping. Pair with DOMPurify or never use with user data."}, "properties": {"repobilityId": 79217, "scanner": "repobility-threat-engine", "fingerprint": "814e8aa6d2016750305035880f97e2d307e623392c8c8a0d1870a92a6dd56b41", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "react-dangerously-set-html", "owasp": "A03:2021", "cwe_ids": ["CWE-79"], "languages": ["javascript", "typescript"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348037+00:00", "triaged_in_corpus": 12, "observations_count": 255650, "ai_coder_pattern_id": 49}, "scanner": "repobility-threat-engine", "correlation_key": "fp|814e8aa6d2016750305035880f97e2d307e623392c8c8a0d1870a92a6dd56b41"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cline-hub/src/webview/src/components/ui/chart.tsx"}, "region": {"startLine": 82}}}]}, {"ruleId": "MINED056", "level": "none", "message": {"text": "[MINED056] React Key As Index (and 3 more): Same pattern found in 3 additional files. Review if needed."}, "properties": {"repobilityId": 79216, "scanner": "repobility-threat-engine", "fingerprint": "6d638efea05789caff597b5fe788564ae810a6add52e01af7c7e66ad58581866", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 3 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "react-key-as-index", "owasp": null, "cwe_ids": ["CWE-682"], "languages": ["typescript", "tsx", "javascript", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348032+00:00", "triaged_in_corpus": 12, "observations_count": 299917, "ai_coder_pattern_id": 135}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|6d638efea05789caff597b5fe788564ae810a6add52e01af7c7e66ad58581866", "aggregated_count": 3}}}, {"ruleId": "MINED056", "level": "none", "message": {"text": "[MINED056] React Key As Index: key={index} in map() \u2014 re-renders the wrong elements on re-order."}, "properties": {"repobilityId": 79215, "scanner": "repobility-threat-engine", "fingerprint": "de98ccf6177c5ee72714fcd790d8a0a028d189c98286d31cc4dd2f2f234b5a90", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "react-key-as-index", "owasp": null, "cwe_ids": ["CWE-682"], "languages": ["typescript", "tsx", "javascript", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348032+00:00", "triaged_in_corpus": 12, "observations_count": 299917, "ai_coder_pattern_id": 135}, "scanner": "repobility-threat-engine", "correlation_key": "fp|de98ccf6177c5ee72714fcd790d8a0a028d189c98286d31cc4dd2f2f234b5a90"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/webview-ui/src/components/account/CreditsHistoryTable.tsx"}, "region": {"startLine": 59}}}]}, {"ruleId": "MINED056", "level": "none", "message": {"text": "[MINED056] React Key As Index: key={index} in map() \u2014 re-renders the wrong elements on re-order."}, "properties": {"repobilityId": 79214, "scanner": "repobility-threat-engine", "fingerprint": "e09944cd75ecfeffb34efd5630626bba66d0761532a730a35deaa322f0177fbb", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "react-key-as-index", "owasp": null, "cwe_ids": ["CWE-682"], "languages": ["typescript", "tsx", "javascript", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348032+00:00", "triaged_in_corpus": 12, "observations_count": 299917, "ai_coder_pattern_id": 135}, "scanner": "repobility-threat-engine", "correlation_key": "fp|e09944cd75ecfeffb34efd5630626bba66d0761532a730a35deaa322f0177fbb"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/examples/vscode/src/webview/src/components/ai-elements/speech-input.tsx"}, "region": {"startLine": 296}}}]}, {"ruleId": "MINED056", "level": "none", "message": {"text": "[MINED056] React Key As Index: key={index} in map() \u2014 re-renders the wrong elements on re-order."}, "properties": {"repobilityId": 79213, "scanner": "repobility-threat-engine", "fingerprint": "3093bf0bfaf33b930b887c5bd125d3a68322dafbcaa028abd2f3fa601eebc139", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "react-key-as-index", "owasp": null, "cwe_ids": ["CWE-682"], "languages": ["typescript", "tsx", "javascript", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348032+00:00", "triaged_in_corpus": 12, "observations_count": 299917, "ai_coder_pattern_id": 135}, "scanner": "repobility-threat-engine", "correlation_key": "fp|3093bf0bfaf33b930b887c5bd125d3a68322dafbcaa028abd2f3fa601eebc139"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cline-hub/src/webview/src/components/ai-elements/speech-input.tsx"}, "region": {"startLine": 296}}}]}, {"ruleId": "SEC040", "level": "none", "message": {"text": "[SEC040] innerHTML XSS \u2014 template literal with server-supplied data (and 20 more): Same pattern found in 20 additional files. Review if needed."}, "properties": {"repobilityId": 79212, "scanner": "repobility-threat-engine", "fingerprint": "c1ac4f7bfd3cb5749074172447bbd649d3b8d62a711943e2d06a444e028cdfdd", "category": "xss", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 20 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 20 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC040", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|c1ac4f7bfd3cb5749074172447bbd649d3b8d62a711943e2d06a444e028cdfdd"}}}, {"ruleId": "MINED049", "level": "none", "message": {"text": "[MINED049] Print Pii: Logging password/token/email/ssn directly to stdout."}, "properties": {"repobilityId": 79208, "scanner": "repobility-threat-engine", "fingerprint": "ce373c9bb25c606d6c6b85999b590846cd1016cee18eb6ca5f789e08f8ee0134", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "print-pii", "owasp": "A09:2021", "cwe_ids": ["CWE-532"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348015+00:00", "triaged_in_corpus": 12, "observations_count": 676566, "ai_coder_pattern_id": 26}, "scanner": "repobility-threat-engine", "correlation_key": "fp|ce373c9bb25c606d6c6b85999b590846cd1016cee18eb6ca5f789e08f8ee0134"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sdk/examples/plugins/weather-metrics.ts"}, "region": {"startLine": 143}}}]}, {"ruleId": "MINED049", "level": "none", "message": {"text": "[MINED049] Print Pii: Logging password/token/email/ssn directly to stdout."}, "properties": {"repobilityId": 79207, "scanner": "repobility-threat-engine", "fingerprint": "7ebd8a66fe478200e2bce6eda36e2ade3d2c20574860af28d8a4d467c3a400e3", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "print-pii", "owasp": "A09:2021", "cwe_ids": ["CWE-532"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348015+00:00", "triaged_in_corpus": 12, "observations_count": 676566, "ai_coder_pattern_id": 26}, "scanner": "repobility-threat-engine", "correlation_key": "fp|7ebd8a66fe478200e2bce6eda36e2ade3d2c20574860af28d8a4d467c3a400e3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/examples/quickstart/src/index.ts"}, "region": {"startLine": 17}}}]}, {"ruleId": "MINED049", "level": "none", "message": {"text": "[MINED049] Print Pii: Logging password/token/email/ssn directly to stdout."}, "properties": {"repobilityId": 79206, "scanner": "repobility-threat-engine", "fingerprint": "2e04abe6e88b744637657ca4fef2368c9f9d014bebccd8ae77bf6bb6e3e36098", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "print-pii", "owasp": "A09:2021", "cwe_ids": ["CWE-532"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348015+00:00", "triaged_in_corpus": 12, "observations_count": 676566, "ai_coder_pattern_id": 26}, "scanner": "repobility-threat-engine", "correlation_key": "fp|2e04abe6e88b744637657ca4fef2368c9f9d014bebccd8ae77bf6bb6e3e36098"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cline-hub/src/server.ts"}, "region": {"startLine": 246}}}]}, {"ruleId": "SEC020", "level": "none", "message": {"text": "[SEC020] Secret Printed to Logs (and 10 more): Same pattern found in 10 additional files. Review if needed."}, "properties": {"repobilityId": 79202, "scanner": "repobility-threat-engine", "fingerprint": "bb1317609c611da67332255eaf2b48f6672536205075bd2f15bfc8371e3028f9", "category": "credential_exposure", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 10 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 10 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC020", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|bb1317609c611da67332255eaf2b48f6672536205075bd2f15bfc8371e3028f9"}}}, {"ruleId": "SEC020", "level": "none", "message": {"text": "[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for troubleshooting."}, "properties": {"repobilityId": 79201, "scanner": "repobility-threat-engine", "fingerprint": "20593f4ddd43a12fbf6acf7580f8e12a81e1c5a2cd1218e621f3194fa81825cf", "category": "credential_exposure", "severity": "info", "confidence": 0.15, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Log message mentions credential-related metadata but does not print a credential-bearing value", "evidence": {"match": "Logger.log(\"Fetching Groq models with API key:\", cleanApiKey.substring(0, 10)", "reason": "Log message mentions credential-related metadata but does not print a credential-bearing value", "rule_id": "SEC020", "scanner": "repobility-threat-engine", "confidence": 0.15, "correlation_key": "secret|token|7|logger.log fetching groq models with api key: cleanapikey.substring 0 10"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/core/controller/models/refreshGroqModels.ts"}, "region": {"startLine": 77}}}]}, {"ruleId": "SEC020", "level": "none", "message": {"text": "[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for troubleshooting."}, "properties": {"repobilityId": 79200, "scanner": "repobility-threat-engine", "fingerprint": "4e570d4e6ef394ba7cd1fc243fed6ced25adc2f5548bc18eb46b343562fbff8a", "category": "credential_exposure", "severity": "info", "confidence": 0.15, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Log message mentions credential-related metadata but does not print a credential-bearing value", "evidence": {"match": "Logger.log(\"Ran out of tokens\")", "reason": "Log message mentions credential-related metadata but does not print a credential-bearing value", "rule_id": "SEC020", "scanner": "repobility-threat-engine", "confidence": 0.15, "correlation_key": "secret|token|14|logger.log ran out of tokens"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/core/api/utils/responses_api_support.ts"}, "region": {"startLine": 146}}}]}, {"ruleId": "SEC020", "level": "none", "message": {"text": "[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for troubleshooting."}, "properties": {"repobilityId": 79199, "scanner": "repobility-threat-engine", "fingerprint": "e29898b603e7af9a5b983845900551bf2f2b036e4c2f0e1ffca01f1d262332d2", "category": "credential_exposure", "severity": "info", "confidence": 0.15, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Log message mentions credential-related metadata but does not print a credential-bearing value", "evidence": {"match": "console.warn(\"WARNING: non-local bind without ROOM_SECRET is not allowed.\")", "reason": "Log message mentions credential-related metadata but does not print a credential-bearing value", "rule_id": "SEC020", "scanner": "repobility-threat-engine", "confidence": 0.15, "correlation_key": "secret|token|24|console.warn warning: non-local bind without room_secret is not allowed."}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cline-hub/src/server.ts"}, "region": {"startLine": 244}}}]}, {"ruleId": "SEC085", "level": "none", "message": {"text": "[SEC085] JS: child_process.exec with non-literal (and 14 more): Same pattern found in 14 additional files. Review if needed."}, "properties": {"repobilityId": 79198, "scanner": "repobility-threat-engine", "fingerprint": "3b059940d4a922f8917e6adef3c44eeefc583e44cc8390ab254549c93b1570e5", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 14 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 14 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC085", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|3b059940d4a922f8917e6adef3c44eeefc583e44cc8390ab254549c93b1570e5"}}}, {"ruleId": "SEC083", "level": "none", "message": {"text": "[SEC083] JS: new RegExp() with non-literal (and 7 more): Same pattern found in 7 additional files. Review if needed."}, "properties": {"repobilityId": 79194, "scanner": "repobility-threat-engine", "fingerprint": "307b83d0878b11fa19a7733164345f24af7c2d92857c6a47165c71bc989c75ca", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 7 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 7 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC083", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|307b83d0878b11fa19a7733164345f24af7c2d92857c6a47165c71bc989c75ca"}}}, {"ruleId": "SEC045", "level": "none", "message": {"text": "[SEC045] eval()/exec() on stored or user-supplied data (and 13 more): Same pattern found in 13 additional files. Review if needed."}, "properties": {"repobilityId": 79190, "scanner": "repobility-threat-engine", "fingerprint": "d14be0fefa073ce5d7f9e06ddc2458b70958a5bc036469eafe870ed8d062de60", "category": "injection", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 13 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 13 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC045", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|d14be0fefa073ce5d7f9e06ddc2458b70958a5bc036469eafe870ed8d062de60"}}}, {"ruleId": "SEC118", "level": "none", "message": {"text": "[SEC118] UUIDv1 / UUIDv3 used for security-sensitive identifier (and 1 more): Same pattern found in 1 additional files. Review if needed."}, "properties": {"repobilityId": 79186, "scanner": "repobility-threat-engine", "fingerprint": "dd5b64e6744e5f494f3eafb49441a01ab167cdd11743c3d4ade0f028db583ab9", "category": "crypto", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 1 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 1 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC118", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|dd5b64e6744e5f494f3eafb49441a01ab167cdd11743c3d4ade0f028db583ab9"}}}, {"ruleId": "SEC118", "level": "none", "message": {"text": "[SEC118] UUIDv1 / UUIDv3 used for security-sensitive identifier: UUIDv1 encodes the MAC address and timestamp, making it predictable. Used as a session token or password-reset key, it's enumerable."}, "properties": {"repobilityId": 79185, "scanner": "repobility-threat-engine", "fingerprint": "c656bc0fd4995838e291f01564acd50cde9df04548295ec76d607e998aed720a", "category": "crypto", "severity": "info", "confidence": 0.1, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Safe pattern 'randomUUID' detected on same line", "evidence": {"match": "crypto.randomUUID", "reason": "Safe pattern 'randomUUID' detected on same line", "rule_id": "SEC118", "scanner": "repobility-threat-engine", "confidence": 0.1, "correlation_key": "code|crypto|token|169|sec118"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/core/api/transform/vscode-lm-format.ts"}, "region": {"startLine": 169}}}]}, {"ruleId": "SEC118", "level": "none", "message": {"text": "[SEC118] UUIDv1 / UUIDv3 used for security-sensitive identifier: UUIDv1 encodes the MAC address and timestamp, making it predictable. Used as a session token or password-reset key, it's enumerable."}, "properties": {"repobilityId": 79184, "scanner": "repobility-threat-engine", "fingerprint": "3f66ea97a58400b1988fcc3be6a36181ce94e5932a4ecba3d2d1a3505d5f7e25", "category": "crypto", "severity": "info", "confidence": 0.1, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Safe pattern 'randomUUID' detected on same line", "evidence": {"match": "crypto.randomUUID", "reason": "Safe pattern 'randomUUID' detected on same line", "rule_id": "SEC118", "scanner": "repobility-threat-engine", "confidence": 0.1, "correlation_key": "code|crypto|token|104|sec118"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/connectors/stores/memory-state.ts"}, "region": {"startLine": 104}}}]}, {"ruleId": "SEC118", "level": "none", "message": {"text": "[SEC118] UUIDv1 / UUIDv3 used for security-sensitive identifier: UUIDv1 encodes the MAC address and timestamp, making it predictable. Used as a session token or password-reset key, it's enumerable."}, "properties": {"repobilityId": 79183, "scanner": "repobility-threat-engine", "fingerprint": "c869c2e714501d1580e0e2d41f9e97609ac244d884f43068534fbb3e291ae357", "category": "crypto", "severity": "info", "confidence": 0.1, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Safe pattern 'randomUUID' detected on same line", "evidence": {"match": "crypto.randomUUID", "reason": "Safe pattern 'randomUUID' detected on same line", "rule_id": "SEC118", "scanner": "repobility-threat-engine", "confidence": 0.1, "correlation_key": "code|crypto|token|219|sec118"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/connectors/stores/file-state.ts"}, "region": {"startLine": 219}}}]}, {"ruleId": "ERR002", "level": "none", "message": {"text": "[ERR002] Empty Catch Block (and 25 more): Same pattern found in 25 additional files. Review if needed."}, "properties": {"repobilityId": 79182, "scanner": "repobility-threat-engine", "fingerprint": "3a74705bd9e4ff0d33b5ff0335bdfc20492dc6ea73cacdf29b288016d79451ba", "category": "error_handling", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 25 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 25 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "ERR002", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|3a74705bd9e4ff0d33b5ff0335bdfc20492dc6ea73cacdf29b288016d79451ba"}}}, {"ruleId": "MINED043", "level": "none", "message": {"text": "[MINED043] Http Not Https (and 6 more): Same pattern found in 6 additional files. Review if needed."}, "properties": {"repobilityId": 79178, "scanner": "repobility-threat-engine", "fingerprint": "e7cd40d7b324241c80937e7a6f550054df46cdde533de8ce7a56977f55a98866", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 6 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "http-not-https", "owasp": "A02:2021", "cwe_ids": ["CWE-319"], "precision": 0.917, "promoted_at": "2026-05-18T14:01:32.347999+00:00", "triaged_in_corpus": 12, "observations_count": 4113831, "ai_coder_pattern_id": 15}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|e7cd40d7b324241c80937e7a6f550054df46cdde533de8ce7a56977f55a98866", "aggregated_count": 6}}}, {"ruleId": "MINED043", "level": "none", "message": {"text": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data."}, "properties": {"repobilityId": 79177, "scanner": "repobility-threat-engine", "fingerprint": "6227cdcab6fd6b2279830f8c96f577adf807b85a68694ca8fdbbb6e54211853d", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "http-not-https", "owasp": "A02:2021", "cwe_ids": ["CWE-319"], "precision": 0.917, "promoted_at": "2026-05-18T14:01:32.347999+00:00", "triaged_in_corpus": 12, "observations_count": 4113831, "ai_coder_pattern_id": 15}, "scanner": "repobility-threat-engine", "correlation_key": "fp|6227cdcab6fd6b2279830f8c96f577adf807b85a68694ca8fdbbb6e54211853d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cline-hub/src/options.ts"}, "region": {"startLine": 34}}}]}, {"ruleId": "MINED043", "level": "none", "message": {"text": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data."}, "properties": {"repobilityId": 79176, "scanner": "repobility-threat-engine", "fingerprint": "2bae3b10ea3a0622ca20e22729fb24c72c78d89c01612e2e509d81b4ab9014a0", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "http-not-https", "owasp": "A02:2021", "cwe_ids": ["CWE-319"], "precision": 0.917, "promoted_at": "2026-05-18T14:01:32.347999+00:00", "triaged_in_corpus": 12, "observations_count": 4113831, "ai_coder_pattern_id": 15}, "scanner": "repobility-threat-engine", "correlation_key": "fp|2bae3b10ea3a0622ca20e22729fb24c72c78d89c01612e2e509d81b4ab9014a0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cline-hub/src/dev.ts"}, "region": {"startLine": 9}}}]}, {"ruleId": "MINED043", "level": "none", "message": {"text": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data."}, "properties": {"repobilityId": 79175, "scanner": "repobility-threat-engine", "fingerprint": "6f93bb89d72ce598844ef6e85585406b56dcaa076d1bc88c151ff60a511a447d", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "http-not-https", "owasp": "A02:2021", "cwe_ids": ["CWE-319"], "precision": 0.917, "promoted_at": "2026-05-18T14:01:32.347999+00:00", "triaged_in_corpus": 12, "observations_count": 4113831, "ai_coder_pattern_id": 15}, "scanner": "repobility-threat-engine", "correlation_key": "fp|6f93bb89d72ce598844ef6e85585406b56dcaa076d1bc88c151ff60a511a447d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/connectors/chat-runtime.ts"}, "region": {"startLine": 81}}}]}, {"ruleId": "SEC128", "level": "none", "message": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake) (and 75 more): Same pattern found in 75 additional files. Review if needed."}, "properties": {"repobilityId": 79174, "scanner": "repobility-threat-engine", "fingerprint": "26e3348caefd8072c58b7fc9936c34c5d2500008b7caf95828d0ce0b44ebe1fb", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 75 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 75 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC128", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|26e3348caefd8072c58b7fc9936c34c5d2500008b7caf95828d0ce0b44ebe1fb"}}}, {"ruleId": "MINED045", "level": "none", "message": {"text": "[MINED045] Ts Non Null Assertion (and 68 more): Same pattern found in 68 additional files. Review if needed."}, "properties": {"repobilityId": 79168, "scanner": "repobility-threat-engine", "fingerprint": "80880c3b7b8805033cbe9cc780fa8b95d109c14aa4da4e1a3887aa4e29cc470b", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 68 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "ts-non-null-assertion", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["typescript", "tsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348005+00:00", "triaged_in_corpus": 12, "observations_count": 1810954, "ai_coder_pattern_id": 105}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|80880c3b7b8805033cbe9cc780fa8b95d109c14aa4da4e1a3887aa4e29cc470b", "aggregated_count": 68}}}, {"ruleId": "MINED045", "level": "none", "message": {"text": "[MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong."}, "properties": {"repobilityId": 79167, "scanner": "repobility-threat-engine", "fingerprint": "bb413c705a6b123c301ad56246d3d4315daf520c47827182310732b5d39b465a", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "ts-non-null-assertion", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["typescript", "tsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348005+00:00", "triaged_in_corpus": 12, "observations_count": 1810954, "ai_coder_pattern_id": 105}, "scanner": "repobility-threat-engine", "correlation_key": "fp|bb413c705a6b123c301ad56246d3d4315daf520c47827182310732b5d39b465a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/connectors/stores/file-state.ts"}, "region": {"startLine": 59}}}]}, {"ruleId": "MINED045", "level": "none", "message": {"text": "[MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong."}, "properties": {"repobilityId": 79166, "scanner": "repobility-threat-engine", "fingerprint": "78b4cad51f4df9e5ce686e691a2b9b0a75443583bee176517eb8bb28a873d490", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "ts-non-null-assertion", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["typescript", "tsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348005+00:00", "triaged_in_corpus": 12, "observations_count": 1810954, "ai_coder_pattern_id": 105}, "scanner": "repobility-threat-engine", "correlation_key": "fp|78b4cad51f4df9e5ce686e691a2b9b0a75443583bee176517eb8bb28a873d490"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/commands/kanban.ts"}, "region": {"startLine": 333}}}]}, {"ruleId": "MINED045", "level": "none", "message": {"text": "[MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError if wrong."}, "properties": {"repobilityId": 79165, "scanner": "repobility-threat-engine", "fingerprint": "8c85dea57e6790a18cd5bb7e2c59669452fcfbf77d45dec8659df2edc3fed85e", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "ts-non-null-assertion", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["typescript", "tsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348005+00:00", "triaged_in_corpus": 12, "observations_count": 1810954, "ai_coder_pattern_id": 105}, "scanner": "repobility-threat-engine", "correlation_key": "fp|8c85dea57e6790a18cd5bb7e2c59669452fcfbf77d45dec8659df2edc3fed85e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/script/publish-npm.ts"}, "region": {"startLine": 127}}}]}, {"ruleId": "MINED044", "level": "none", "message": {"text": "[MINED044] Js Console Log Prod (and 136 more): Same pattern found in 136 additional files. Review if needed."}, "properties": {"repobilityId": 79164, "scanner": "repobility-threat-engine", "fingerprint": "aaf267603f2140ee316eef57944f6ff1e257c34c7858edd52064f3ddc8592caa", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 136 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "js-console-log-prod", "owasp": null, "cwe_ids": ["CWE-532"], "languages": ["javascript", "typescript", "tsx", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348003+00:00", "triaged_in_corpus": 10, "observations_count": 1940833, "ai_coder_pattern_id": 102}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|aaf267603f2140ee316eef57944f6ff1e257c34c7858edd52064f3ddc8592caa", "aggregated_count": 136}}}, {"ruleId": "MINED044", "level": "none", "message": {"text": "[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed."}, "properties": {"repobilityId": 79163, "scanner": "repobility-threat-engine", "fingerprint": "9696497145f327b5c748cc551e14eecdfa98b0327f798f9a62934906f82dbe7b", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "js-console-log-prod", "owasp": null, "cwe_ids": ["CWE-532"], "languages": ["javascript", "typescript", "tsx", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348003+00:00", "triaged_in_corpus": 10, "observations_count": 1940833, "ai_coder_pattern_id": 102}, "scanner": "repobility-threat-engine", "correlation_key": "fp|9696497145f327b5c748cc551e14eecdfa98b0327f798f9a62934906f82dbe7b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/script/guard-direct-publish.ts"}, "region": {"startLine": 15}}}]}, {"ruleId": "MINED044", "level": "none", "message": {"text": "[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed."}, "properties": {"repobilityId": 79162, "scanner": "repobility-threat-engine", "fingerprint": "09c4200e31cf9b7d02d98586f48b56d9c5fb35ccae891d1fab784274f9cc73e1", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "js-console-log-prod", "owasp": null, "cwe_ids": ["CWE-532"], "languages": ["javascript", "typescript", "tsx", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348003+00:00", "triaged_in_corpus": 10, "observations_count": 1940833, "ai_coder_pattern_id": 102}, "scanner": "repobility-threat-engine", "correlation_key": "fp|09c4200e31cf9b7d02d98586f48b56d9c5fb35ccae891d1fab784274f9cc73e1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/script/build.ts"}, "region": {"startLine": 52}}}]}, {"ruleId": "MINED044", "level": "none", "message": {"text": "[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed."}, "properties": {"repobilityId": 79161, "scanner": "repobility-threat-engine", "fingerprint": "9d2398fe3e46f80369fe7235b9b7e075c8954a542fd9822fa53141999d42ecbb", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "js-console-log-prod", "owasp": null, "cwe_ids": ["CWE-532"], "languages": ["javascript", "typescript", "tsx", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348003+00:00", "triaged_in_corpus": 10, "observations_count": 1940833, "ai_coder_pattern_id": 102}, "scanner": "repobility-threat-engine", "correlation_key": "fp|9d2398fe3e46f80369fe7235b9b7e075c8954a542fd9822fa53141999d42ecbb"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/bun.mts"}, "region": {"startLine": 60}}}]}, {"ruleId": "SEC005", "level": "none", "message": {"text": "[SEC005] Command Injection Risk (and 1 more): Same pattern found in 1 additional files. Review if needed."}, "properties": {"repobilityId": 79159, "scanner": "repobility-threat-engine", "fingerprint": "1ec183c5587b0294626eea573239a67d50c9c28a5ce594bf1f3d522841fe9bfb", "category": "injection", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 1 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 1 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC005", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|1ec183c5587b0294626eea573239a67d50c9c28a5ce594bf1f3d522841fe9bfb"}}}, {"ruleId": "MINED067", "level": "none", "message": {"text": "[MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang forever."}, "properties": {"repobilityId": 79155, "scanner": "repobility-threat-engine", "fingerprint": "f94ffbd02c7701af3641a661f7c0597cbf0146eb1a2cd253fcd88b4313e0f018", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "python-requests-no-timeout", "owasp": null, "cwe_ids": ["CWE-400"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348058+00:00", "triaged_in_corpus": 12, "observations_count": 45429, "ai_coder_pattern_id": 122}, "scanner": "repobility-threat-engine", "correlation_key": "fp|f94ffbd02c7701af3641a661f7c0597cbf0146eb1a2cd253fcd88b4313e0f018"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/coverage_check/github_api.py"}, "region": {"startLine": 123}}}]}, {"ruleId": "SEC029", "level": "none", "message": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input (and 74 more): Same pattern found in 74 additional files. Review if needed."}, "properties": {"repobilityId": 79153, "scanner": "repobility-threat-engine", "fingerprint": "6277d83c85f735eee40d4010c7477d6f5a02180c02b52a08f95a4f9359fe976d", "category": "ssrf", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 74 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 74 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC029", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|6277d83c85f735eee40d4010c7477d6f5a02180c02b52a08f95a4f9359fe976d"}}}, {"ruleId": "COMP001", "level": "none", "message": {"text": "[COMP001] High cognitive complexity (and 5 more): Same pattern found in 5 additional files. Review if needed."}, "properties": {"repobilityId": 79148, "scanner": "repobility-threat-engine", "fingerprint": "88bc83404cd2ee7008de79d63577b83ca6520a75ef847238a1ec8a3084ede646", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 5 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"scanner": "repobility-threat-engine", "function": "main", "breakdown": {"if": 6, "elif": 6, "else": 4, "nested_bonus": 5}, "aggregated": true, "complexity": 21, "correlation_key": "fp|88bc83404cd2ee7008de79d63577b83ca6520a75ef847238a1ec8a3084ede646", "aggregated_count": 5}}}, {"ruleId": "MINED115", "level": "error", "message": {"text": "[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 79365, "scanner": "repobility-supply-chain", "fingerprint": "7e746fb538b077587a71c2093723e0f4db7b94c92b3c23ddb4082a17c58f4923", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|7e746fb538b077587a71c2093723e0f4db7b94c92b3c23ddb4082a17c58f4923"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ext-vscode-test.yml"}, "region": {"startLine": 225}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "[MINED115] Action `actions/upload-artifact` pinned to mutable ref `@v4`: `uses: actions/upload-artifact@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 79364, "scanner": "repobility-supply-chain", "fingerprint": "3d739472acaf3526e9556173cdf0029897322e9160bdd67ba7fab95b296dcb8c", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|3d739472acaf3526e9556173cdf0029897322e9160bdd67ba7fab95b296dcb8c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ext-vscode-test.yml"}, "region": {"startLine": 207}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "[MINED115] Action `actions/cache` pinned to mutable ref `@v4`: `uses: actions/cache@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 79363, "scanner": "repobility-supply-chain", "fingerprint": "7daa5c0465024efc49efee493e50d946af82e1c5643c071c5ac72bf909fc2f1d", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|7daa5c0465024efc49efee493e50d946af82e1c5643c071c5ac72bf909fc2f1d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ext-vscode-test.yml"}, "region": {"startLine": 153}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "[MINED115] Action `actions/setup-node` pinned to mutable ref `@v4`: `uses: actions/setup-node@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 79362, "scanner": "repobility-supply-chain", "fingerprint": "fc9b37a13aae11683b39309b7f9cfdbfc032420d4bf830dcec769cd9e74e8b86", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|fc9b37a13aae11683b39309b7f9cfdbfc032420d4bf830dcec769cd9e74e8b86"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ext-vscode-test.yml"}, "region": {"startLine": 127}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 79361, "scanner": "repobility-supply-chain", "fingerprint": "99828c0dd90f8d0ae3d0c90e610b26d2998e63969673439713d6524722d4690b", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|99828c0dd90f8d0ae3d0c90e610b26d2998e63969673439713d6524722d4690b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ext-vscode-test.yml"}, "region": {"startLine": 124}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "[MINED115] Action `actions/setup-node` pinned to mutable ref `@v4`: `uses: actions/setup-node@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 79360, "scanner": "repobility-supply-chain", "fingerprint": "4462d9aeb4895ae7a18f5f317cc83df0cf8a4e3f712b14d653aeea3e80a7536d", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|4462d9aeb4895ae7a18f5f317cc83df0cf8a4e3f712b14d653aeea3e80a7536d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ext-vscode-test.yml"}, "region": {"startLine": 86}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 79359, "scanner": "repobility-supply-chain", "fingerprint": "8c3598f66cba754a46fb5377f6be7f9323999f3582104d38c3146e15e6d5ae24", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|8c3598f66cba754a46fb5377f6be7f9323999f3582104d38c3146e15e6d5ae24"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ext-vscode-test.yml"}, "region": {"startLine": 83}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "[MINED115] Action `dorny/paths-filter` pinned to mutable ref `@v3`: `uses: dorny/paths-filter@v3` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 79358, "scanner": "repobility-supply-chain", "fingerprint": "d8583cb16a4afbd59d16981941a74f279eb9a815863ed2493ba2f8fa646f5aec", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|d8583cb16a4afbd59d16981941a74f279eb9a815863ed2493ba2f8fa646f5aec"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ext-vscode-test.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 79357, "scanner": "repobility-supply-chain", "fingerprint": "0cde3993628b8bc51f3c68efd14a5f8b5064adf49e63e985913243a4038407bd", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|0cde3993628b8bc51f3c68efd14a5f8b5064adf49e63e985913243a4038407bd"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ext-vscode-test.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "[MINED115] Action `actions/upload-artifact` pinned to mutable ref `@v4`: `uses: actions/upload-artifact@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 79356, "scanner": "repobility-supply-chain", "fingerprint": "def67f49910b3373c8cd47a4bbaf4a32c5279c811ff38df0b1153dbe72ac571f", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|def67f49910b3373c8cd47a4bbaf4a32c5279c811ff38df0b1153dbe72ac571f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ext-vscode-test-e2e.yml"}, "region": {"startLine": 156}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "[MINED115] Action `actions/cache` pinned to mutable ref `@v4`: `uses: actions/cache@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 79355, "scanner": "repobility-supply-chain", "fingerprint": "16793bea686199ab36b57216afb07fe3bbd590a24d4ff894870881939cc64913", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|16793bea686199ab36b57216afb07fe3bbd590a24d4ff894870881939cc64913"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ext-vscode-test-e2e.yml"}, "region": {"startLine": 120}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "[MINED115] Action `actions/cache` pinned to mutable ref `@v4`: `uses: actions/cache@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 79354, "scanner": "repobility-supply-chain", "fingerprint": "bcaff5c98e800b32399a78829fbfcd117166481dacafc54b4e6799f88f1309b4", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|bcaff5c98e800b32399a78829fbfcd117166481dacafc54b4e6799f88f1309b4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ext-vscode-test-e2e.yml"}, "region": {"startLine": 110}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "[MINED115] Action `actions/cache` pinned to mutable ref `@v4`: `uses: actions/cache@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 79353, "scanner": "repobility-supply-chain", "fingerprint": "654117c45c1a32efd33db9b3d9fe81904f936b1e13950928e6caee01eebf8493", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|654117c45c1a32efd33db9b3d9fe81904f936b1e13950928e6caee01eebf8493"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ext-vscode-test-e2e.yml"}, "region": {"startLine": 102}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "[MINED115] Action `actions/cache` pinned to mutable ref `@v4`: `uses: actions/cache@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 79352, "scanner": "repobility-supply-chain", "fingerprint": "dcbbd1552b33c17f51f26e6c134845fff88192beeae751a15259d6487f6731b6", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|dcbbd1552b33c17f51f26e6c134845fff88192beeae751a15259d6487f6731b6"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ext-vscode-test-e2e.yml"}, "region": {"startLine": 94}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "[MINED115] Action `actions/setup-node` pinned to mutable ref `@v4`: `uses: actions/setup-node@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 79351, "scanner": "repobility-supply-chain", "fingerprint": "1aaa1ac9b9f94f446264919edb624120124f6a1ac7ecb55428c8a12a2b1ef845", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|1aaa1ac9b9f94f446264919edb624120124f6a1ac7ecb55428c8a12a2b1ef845"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ext-vscode-test-e2e.yml"}, "region": {"startLine": 88}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 79350, "scanner": "repobility-supply-chain", "fingerprint": "db7c8d7bd5977bab4cbb5384e17f0e1e6bcd70373cca7e3e9e38eb58d0095cc2", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|db7c8d7bd5977bab4cbb5384e17f0e1e6bcd70373cca7e3e9e38eb58d0095cc2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ext-vscode-test-e2e.yml"}, "region": {"startLine": 86}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "[MINED115] Action `dorny/paths-filter` pinned to mutable ref `@v3`: `uses: dorny/paths-filter@v3` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 79349, "scanner": "repobility-supply-chain", "fingerprint": "1e221f7d94d849244f2899bfcb676298b99369e91994ebb8f3243d151ac3c0eb", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|1e221f7d94d849244f2899bfcb676298b99369e91994ebb8f3243d151ac3c0eb"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ext-vscode-test-e2e.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 79348, "scanner": "repobility-supply-chain", "fingerprint": "1ba6e54a2f3415dee3386049866e6de0ad50a6d1e81f5cd5f55ca42760e9de11", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|1ba6e54a2f3415dee3386049866e6de0ad50a6d1e81f5cd5f55ca42760e9de11"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ext-vscode-test-e2e.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "[MINED115] Action `actions/setup-node` pinned to mutable ref `@v4`: `uses: actions/setup-node@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 79347, "scanner": "repobility-supply-chain", "fingerprint": "c7a39e07d2a2fa252b279d742298f3665322d6fba934b14a401e98e0af2baac8", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|c7a39e07d2a2fa252b279d742298f3665322d6fba934b14a401e98e0af2baac8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ext-vscode-publish-nightly.yml"}, "region": {"startLine": 54}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 79346, "scanner": "repobility-supply-chain", "fingerprint": "baa3aa1d2d481861f053d33af3f0c3b53d2de01d971de56785ddf56de2b73ffd", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|baa3aa1d2d481861f053d33af3f0c3b53d2de01d971de56785ddf56de2b73ffd"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ext-vscode-publish-nightly.yml"}, "region": {"startLine": 40}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "[MINED115] Action `slackapi/slack-github-action` pinned to mutable ref `@v3.0.1`: `uses: slackapi/slack-github-action@v3.0.1` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 79345, "scanner": "repobility-supply-chain", "fingerprint": "0ab8c5e9f2621467f79f64a5be0c07dac63873606aa0f2c87f1d032ef3501f7f", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|0ab8c5e9f2621467f79f64a5be0c07dac63873606aa0f2c87f1d032ef3501f7f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ext-vscode-publish-stable.yml"}, "region": {"startLine": 210}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "[MINED115] Action `softprops/action-gh-release` pinned to mutable ref `@v1`: `uses: softprops/action-gh-release@v1` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 79344, "scanner": "repobility-supply-chain", "fingerprint": "0a3169f21e3ba684acc119fa011906848bec50de7b8a58a570ee11275f899863", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|0a3169f21e3ba684acc119fa011906848bec50de7b8a58a570ee11275f899863"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ext-vscode-publish-stable.yml"}, "region": {"startLine": 197}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "[MINED115] Action `actions/setup-node` pinned to mutable ref `@v4`: `uses: actions/setup-node@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 79343, "scanner": "repobility-supply-chain", "fingerprint": "753e1d7c661e4dd988d6652b28ee8e47e90b171b9ef2a397800202fafd67a85e", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|753e1d7c661e4dd988d6652b28ee8e47e90b171b9ef2a397800202fafd67a85e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ext-vscode-publish-stable.yml"}, "region": {"startLine": 113}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 79342, "scanner": "repobility-supply-chain", "fingerprint": "86fc7c58fc38d749d06bbf8a41eb5ddff325a9f3fc98ab40cd5b96664b0c19bc", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|86fc7c58fc38d749d06bbf8a41eb5ddff325a9f3fc98ab40cd5b96664b0c19bc"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ext-vscode-publish-stable.yml"}, "region": {"startLine": 44}}}]}, {"ruleId": "MINED115", "level": "error", "message": {"text": "[MINED115] Action `actions/github-script` pinned to mutable ref `@v7`: `uses: actions/github-script@v7` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect ~23K repos. Pin to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 79341, "scanner": "repobility-supply-chain", "fingerprint": "c1b2d9ac7e1c3859285d96235f3f66d3f5d9ef98fe33261545bdca3a826db963", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|c1b2d9ac7e1c3859285d96235f3f66d3f5d9ef98fe33261545bdca3a826db963"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/repo-label-issues.yml"}, "region": {"startLine": 13}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.assertIn` used but never assigned in __init__: Method `test_generate_comment` of class `TestCoverage` reads `self.assertIn`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 79337, "scanner": "repobility-ast-engine", "fingerprint": "80a569d907f7afa5c95ff024b9f39df1fabcb70fa677e59b0477381df2974f71", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|80a569d907f7afa5c95ff024b9f39df1fabcb70fa677e59b0477381df2974f71"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/tests/coverage_check_test.py"}, "region": {"startLine": 195}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.assertIn` used but never assigned in __init__: Method `test_generate_comment` of class `TestCoverage` reads `self.assertIn`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 79336, "scanner": "repobility-ast-engine", "fingerprint": "f8b3c4fa58f163086004a67aa100381647b265577a1320782054fbba3574c8d3", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|f8b3c4fa58f163086004a67aa100381647b265577a1320782054fbba3574c8d3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/tests/coverage_check_test.py"}, "region": {"startLine": 194}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.assertIn` used but never assigned in __init__: Method `test_generate_comment` of class `TestCoverage` reads `self.assertIn`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 79335, "scanner": "repobility-ast-engine", "fingerprint": "911b39e83dcec28fb2a7b1cd199c1ebaa927cdd5e4018032ca7e54c657ed5c17", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|911b39e83dcec28fb2a7b1cd199c1ebaa927cdd5e4018032ca7e54c657ed5c17"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/tests/coverage_check_test.py"}, "region": {"startLine": 191}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.assertIn` used but never assigned in __init__: Method `test_generate_comment` of class `TestCoverage` reads `self.assertIn`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 79334, "scanner": "repobility-ast-engine", "fingerprint": "c9965faa0f4773a7e9c4d8538308d286ef7ab87875cadeca123e2c9fba0cb804", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|c9965faa0f4773a7e9c4d8538308d286ef7ab87875cadeca123e2c9fba0cb804"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/tests/coverage_check_test.py"}, "region": {"startLine": 190}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.assertIn` used but never assigned in __init__: Method `test_generate_comment` of class `TestCoverage` reads `self.assertIn`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 79333, "scanner": "repobility-ast-engine", "fingerprint": "8445009ed0a74d0a078b29e62e67cce794cc4c0055162fb07126393bc4ef80fa", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|8445009ed0a74d0a078b29e62e67cce794cc4c0055162fb07126393bc4ef80fa"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/tests/coverage_check_test.py"}, "region": {"startLine": 189}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.assertIn` used but never assigned in __init__: Method `test_generate_comment` of class `TestCoverage` reads `self.assertIn`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 79332, "scanner": "repobility-ast-engine", "fingerprint": "370b86d93c8f3d559fa53d844f00e7448048920f3ca71df5c2c65430d92dbca9", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|370b86d93c8f3d559fa53d844f00e7448048920f3ca71df5c2c65430d92dbca9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/tests/coverage_check_test.py"}, "region": {"startLine": 188}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.assertIn` used but never assigned in __init__: Method `test_generate_comment` of class `TestCoverage` reads `self.assertIn`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 79331, "scanner": "repobility-ast-engine", "fingerprint": "8bf22e5c77334b49ba6115be9d720ab891fccfd585124b50c703b56278d07247", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|8bf22e5c77334b49ba6115be9d720ab891fccfd585124b50c703b56278d07247"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/tests/coverage_check_test.py"}, "region": {"startLine": 185}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.assertIn` used but never assigned in __init__: Method `test_generate_comment` of class `TestCoverage` reads `self.assertIn`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 79330, "scanner": "repobility-ast-engine", "fingerprint": "372e17a1eb535292eb76b9305ee323e7ee946cec5f2c3513b49e50c8c8f9547f", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|372e17a1eb535292eb76b9305ee323e7ee946cec5f2c3513b49e50c8c8f9547f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/tests/coverage_check_test.py"}, "region": {"startLine": 184}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.assertIn` used but never assigned in __init__: Method `test_generate_comment` of class `TestCoverage` reads `self.assertIn`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 79329, "scanner": "repobility-ast-engine", "fingerprint": "4d29ce0167eb3efc431cfbe1adff610b127d92db1aea08dbcaf4ed6936f8e6fd", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|4d29ce0167eb3efc431cfbe1adff610b127d92db1aea08dbcaf4ed6936f8e6fd"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/tests/coverage_check_test.py"}, "region": {"startLine": 183}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.assertIn` used but never assigned in __init__: Method `test_generate_comment` of class `TestCoverage` reads `self.assertIn`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 79328, "scanner": "repobility-ast-engine", "fingerprint": "6208e147150a87d61d7d650445242a2ed62f683f22c56b0566d745b3bbea4abf", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|6208e147150a87d61d7d650445242a2ed62f683f22c56b0566d745b3bbea4abf"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/tests/coverage_check_test.py"}, "region": {"startLine": 182}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.assertEqual` used but never assigned in __init__: Method `test_compare_coverage` of class `TestCoverage` reads `self.assertEqual`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 79327, "scanner": "repobility-ast-engine", "fingerprint": "82ba8f4b356dd94ce7e1a0f1be57abee6eaaebe34c4c3237c0172f98ac56fa3f", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|82ba8f4b356dd94ce7e1a0f1be57abee6eaaebe34c4c3237c0172f98ac56fa3f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/tests/coverage_check_test.py"}, "region": {"startLine": 172}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.assertFalse` used but never assigned in __init__: Method `test_compare_coverage` of class `TestCoverage` reads `self.assertFalse`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 79326, "scanner": "repobility-ast-engine", "fingerprint": "272f320049be9b011041dec4ff8ec03d397977bc6d0f5fdec06a291edef52165", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|272f320049be9b011041dec4ff8ec03d397977bc6d0f5fdec06a291edef52165"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/tests/coverage_check_test.py"}, "region": {"startLine": 171}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.assertEqual` used but never assigned in __init__: Method `test_compare_coverage` of class `TestCoverage` reads `self.assertEqual`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 79325, "scanner": "repobility-ast-engine", "fingerprint": "0d14f42ce6071af615ce55b8420b117b107e37f026785c38e1d913d8b8b6fd80", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|0d14f42ce6071af615ce55b8420b117b107e37f026785c38e1d913d8b8b6fd80"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/tests/coverage_check_test.py"}, "region": {"startLine": 167}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.assertTrue` used but never assigned in __init__: Method `test_compare_coverage` of class `TestCoverage` reads `self.assertTrue`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 79324, "scanner": "repobility-ast-engine", "fingerprint": "c4f082fef4b27aa828bd1a81993e99d738382442bf35c1dcc1c69903f92c7c5c", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|c4f082fef4b27aa828bd1a81993e99d738382442bf35c1dcc1c69903f92c7c5c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/tests/coverage_check_test.py"}, "region": {"startLine": 166}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.assertEqual` used but never assigned in __init__: Method `test_compare_coverage` of class `TestCoverage` reads `self.assertEqual`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 79323, "scanner": "repobility-ast-engine", "fingerprint": "0ec1e956aff655d2f52342a2a6139d728cb28c2208719b2006a541ae110d3bd6", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|0ec1e956aff655d2f52342a2a6139d728cb28c2208719b2006a541ae110d3bd6"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/tests/coverage_check_test.py"}, "region": {"startLine": 162}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.assertFalse` used but never assigned in __init__: Method `test_compare_coverage` of class `TestCoverage` reads `self.assertFalse`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 79322, "scanner": "repobility-ast-engine", "fingerprint": "e399156b6af5dad56dabb706de1426bc4a59afb3d77224e1a87905cbe5404fbe", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|e399156b6af5dad56dabb706de1426bc4a59afb3d77224e1a87905cbe5404fbe"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/tests/coverage_check_test.py"}, "region": {"startLine": 161}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.assertLessEqual` used but never assigned in __init__: Method `test_extract_coverage` of class `TestCoverage` reads `self.assertLessEqual`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 79321, "scanner": "repobility-ast-engine", "fingerprint": "f7062ea3c08c54c94341d669e4d164551475714f8863f8f803b65b8e57dff45c", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|f7062ea3c08c54c94341d669e4d164551475714f8863f8f803b65b8e57dff45c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/tests/coverage_check_test.py"}, "region": {"startLine": 152}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.assertGreaterEqual` used but never assigned in __init__: Method `test_extract_coverage` of class `TestCoverage` reads `self.assertGreaterEqual`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 79320, "scanner": "repobility-ast-engine", "fingerprint": "8b5f17eb961447baa06d6db16a8b0466ba756968e9f73d770c319f7cc7ef9721", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|8b5f17eb961447baa06d6db16a8b0466ba756968e9f73d770c319f7cc7ef9721"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/tests/coverage_check_test.py"}, "region": {"startLine": 151}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.assertIsInstance` used but never assigned in __init__: Method `test_extract_coverage` of class `TestCoverage` reads `self.assertIsInstance`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 79319, "scanner": "repobility-ast-engine", "fingerprint": "2376606fde9e339959d0c6f59b0d3d569d4ce43eeb7293ec6c835717e63befb1", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|2376606fde9e339959d0c6f59b0d3d569d4ce43eeb7293ec6c835717e63befb1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/tests/coverage_check_test.py"}, "region": {"startLine": 148}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.assertLessEqual` used but never assigned in __init__: Method `test_extract_coverage` of class `TestCoverage` reads `self.assertLessEqual`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 79318, "scanner": "repobility-ast-engine", "fingerprint": "b67bdea1c820e5af118e2ffd34862ac74fc184bc0bff8c43cc59bf3250d70443", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|b67bdea1c820e5af118e2ffd34862ac74fc184bc0bff8c43cc59bf3250d70443"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/tests/coverage_check_test.py"}, "region": {"startLine": 134}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.assertGreaterEqual` used but never assigned in __init__: Method `test_extract_coverage` of class `TestCoverage` reads `self.assertGreaterEqual`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 79317, "scanner": "repobility-ast-engine", "fingerprint": "3ea3d3c5b0dceca2bfe791677838c36019a4ef8ad2d18dd39ef182bfb7953504", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|3ea3d3c5b0dceca2bfe791677838c36019a4ef8ad2d18dd39ef182bfb7953504"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/tests/coverage_check_test.py"}, "region": {"startLine": 133}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.assertIsInstance` used but never assigned in __init__: Method `test_extract_coverage` of class `TestCoverage` reads `self.assertIsInstance`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 79316, "scanner": "repobility-ast-engine", "fingerprint": "83ac16b94d844f72f728e74eafe6091642661907a2cdb80ca845cdc3ceefdcfa", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|83ac16b94d844f72f728e74eafe6091642661907a2cdb80ca845cdc3ceefdcfa"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/tests/coverage_check_test.py"}, "region": {"startLine": 130}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.assertTrue` used but never assigned in __init__: Method `test_extract_coverage` of class `TestCoverage` reads `self.assertTrue`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 79315, "scanner": "repobility-ast-engine", "fingerprint": "359e750ae5a5782dba197dd7ce3d42a901a17d6a2d5d50d4d962c9947010507d", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|359e750ae5a5782dba197dd7ce3d42a901a17d6a2d5d50d4d962c9947010507d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/tests/coverage_check_test.py"}, "region": {"startLine": 116}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.assertTrue` used but never assigned in __init__: Method `test_extract_coverage` of class `TestCoverage` reads `self.assertTrue`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 79314, "scanner": "repobility-ast-engine", "fingerprint": "f0736a1727689a2a037604915706776c5567c02d4f36b04c96c93fea8c265758", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|f0736a1727689a2a037604915706776c5567c02d4f36b04c96c93fea8c265758"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/tests/coverage_check_test.py"}, "region": {"startLine": 114}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "[MINED106] Phantom test coverage: test_set_github_output: Test function `test_set_github_output` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "properties": {"repobilityId": 79313, "scanner": "repobility-ast-engine", "fingerprint": "6f06022013295d5f6563d85973a71cbcebb6eb29807094eedc30747f9f340751", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|6f06022013295d5f6563d85973a71cbcebb6eb29807094eedc30747f9f340751"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/tests/coverage_check_test.py"}, "region": {"startLine": 244}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "[MINED106] Phantom test coverage: test_post_comment_update: Test function `test_post_comment_update` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "properties": {"repobilityId": 79312, "scanner": "repobility-ast-engine", "fingerprint": "ab85c078c380f8dafdb639303b6078aa19a33f75876cd9b5229d34e58d0a068b", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|ab85c078c380f8dafdb639303b6078aa19a33f75876cd9b5229d34e58d0a068b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/tests/coverage_check_test.py"}, "region": {"startLine": 222}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "[MINED106] Phantom test coverage: test_post_comment_new: Test function `test_post_comment_new` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "properties": {"repobilityId": 79311, "scanner": "repobility-ast-engine", "fingerprint": "133ed73ef251638c305cb231a513b6f6c599e064001051715ac379ce5bc98b0d", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|133ed73ef251638c305cb231a513b6f6c599e064001051715ac379ce5bc98b0d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/tests/coverage_check_test.py"}, "region": {"startLine": 200}}}]}, {"ruleId": "MINED004", "level": "error", "message": {"text": "[MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums)."}, "properties": {"repobilityId": 79263, "scanner": "repobility-threat-engine", "fingerprint": "1b92c570cf5c6c274edba1413012b30f26c5e91072ef219308f2f83b69471fc5", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "weak-crypto", "owasp": "A02:2021", "cwe_ids": ["CWE-327"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347906+00:00", "triaged_in_corpus": 15, "observations_count": 303181, "ai_coder_pattern_id": 13}, "scanner": "repobility-threat-engine", "correlation_key": "fp|1b92c570cf5c6c274edba1413012b30f26c5e91072ef219308f2f83b69471fc5"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sdk/packages/core/src/extensions/mcp/name-transform.ts"}, "region": {"startLine": 11}}}]}, {"ruleId": "MINED004", "level": "error", "message": {"text": "[MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums)."}, "properties": {"repobilityId": 79262, "scanner": "repobility-threat-engine", "fingerprint": "65c3f2271c929fcc9608422c7c82b9b94404e1fc4c701ae644bbeac1e06480af", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "weak-crypto", "owasp": "A02:2021", "cwe_ids": ["CWE-327"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347906+00:00", "triaged_in_corpus": 15, "observations_count": 303181, "ai_coder_pattern_id": 13}, "scanner": "repobility-threat-engine", "correlation_key": "fp|65c3f2271c929fcc9608422c7c82b9b94404e1fc4c701ae644bbeac1e06480af"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/shared/storage/adapters.ts"}, "region": {"startLine": 124}}}]}, {"ruleId": "MINED031", "level": "error", "message": {"text": "[MINED031] React Direct State Mutation: this.state.X = Y mutates without setState. React wont re-render."}, "properties": {"repobilityId": 79259, "scanner": "repobility-threat-engine", "fingerprint": "c49345d6d11136666f4146073611a9d1c1934f7b255f464627af98fb489fd2c0", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "react-direct-state-mutation", "owasp": null, "cwe_ids": ["CWE-682"], "languages": ["typescript", "tsx", "javascript", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347971+00:00", "triaged_in_corpus": 15, "observations_count": 6168, "ai_coder_pattern_id": 137}, "scanner": "repobility-threat-engine", "correlation_key": "fp|c49345d6d11136666f4146073611a9d1c1934f7b255f464627af98fb489fd2c0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/integrations/terminal/standalone/StandaloneTerminal.ts"}, "region": {"startLine": 104}}}]}, {"ruleId": "MINED027", "level": "error", "message": {"text": "[MINED027] React State Array Mutation: state.X.push/splice/sort followed by setState \u2014 React skips re-render on mutated reference."}, "properties": {"repobilityId": 79257, "scanner": "repobility-threat-engine", "fingerprint": "00afa02db03d0d85859850ae769eda7cb404853c11b1229163177ef9a52c6095", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "react-state-array-mutation", "owasp": null, "cwe_ids": ["CWE-682"], "languages": ["typescript", "tsx", "javascript", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347961+00:00", "triaged_in_corpus": 15, "observations_count": 14444, "ai_coder_pattern_id": 136}, "scanner": "repobility-threat-engine", "correlation_key": "fp|00afa02db03d0d85859850ae769eda7cb404853c11b1229163177ef9a52c6095"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sdk/packages/core/src/runtime/turn-queue/pending-prompt-service.ts"}, "region": {"startLine": 100}}}]}, {"ruleId": "MINED027", "level": "error", "message": {"text": "[MINED027] React State Array Mutation: state.X.push/splice/sort followed by setState \u2014 React skips re-render on mutated reference."}, "properties": {"repobilityId": 79256, "scanner": "repobility-threat-engine", "fingerprint": "12e6be37eddb49fc6cc33b3943d6919b967efc96fcf20ad45609340a48a92c76", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "react-state-array-mutation", "owasp": null, "cwe_ids": ["CWE-682"], "languages": ["typescript", "tsx", "javascript", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347961+00:00", "triaged_in_corpus": 15, "observations_count": 14444, "ai_coder_pattern_id": 136}, "scanner": "repobility-threat-engine", "correlation_key": "fp|12e6be37eddb49fc6cc33b3943d6919b967efc96fcf20ad45609340a48a92c76"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/core/task/tools/utils/ToolHookUtils.ts"}, "region": {"startLine": 159}}}]}, {"ruleId": "SEC114", "level": "error", "message": {"text": "[SEC114] path.join / Path() on user-controlled segment without containment check: filepath.Clean / path.Join on attacker-supplied segments does NOT prevent escape from the base directory. `../../../etc/passwd` resolves cleanly."}, "properties": {"repobilityId": 79230, "scanner": "repobility-threat-engine", "fingerprint": "3263fe74acf6c6450456da9c9a6b596573b15dd88e990a8c93b58c66fd1469fa", "category": "path_traversal", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "path.resolve(input", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC114", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|path_traversal|token|109|sec114"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/testing-platform/index.ts"}, "region": {"startLine": 109}}}]}, {"ruleId": "SEC114", "level": "error", "message": {"text": "[SEC114] path.join / Path() on user-controlled segment without containment check: filepath.Clean / path.Join on attacker-supplied segments does NOT prevent escape from the base directory. `../../../etc/passwd` resolves cleanly."}, "properties": {"repobilityId": 79229, "scanner": "repobility-threat-engine", "fingerprint": "226cd9b41cd9ac7ad915e15d4aef2b7cc1e674440b9b89cd6ba0323e90ecf84e", "category": "path_traversal", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "path.join(globalStoragePath, \"tasks\", request", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC114", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|path_traversal|token|14|sec114"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/core/controller/file/openDiskConversationHistory.ts"}, "region": {"startLine": 14}}}]}, {"ruleId": "SEC114", "level": "error", "message": {"text": "[SEC114] path.join / Path() on user-controlled segment without containment check: filepath.Clean / path.Join on attacker-supplied segments does NOT prevent escape from the base directory. `../../../etc/passwd` resolves cleanly."}, "properties": {"repobilityId": 79228, "scanner": "repobility-threat-engine", "fingerprint": "20f3904b3ea6c9779bc5a6e6eb5de7e56cc90d6a0a07f3c915a79519c6884076", "category": "path_traversal", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "path.resolve(input", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC114", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|path_traversal|token|156|sec114"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/scripts/testing-platform-orchestrator.ts"}, "region": {"startLine": 156}}}]}, {"ruleId": "SEC080", "level": "error", "message": {"text": "[SEC080] Python: tarfile.extractall without filter: tarfile.extract*() without filter='data' allows path-traversal (CVE-2007-4559, fixed via PEP 706 in 3.12). Ported from bandit B202 (Apache-2.0)."}, "properties": {"repobilityId": 79223, "scanner": "repobility-threat-engine", "fingerprint": "99abdff6c7547692faf8c3a56f084675b5d742fa64fbb7adbafa3807a28dacd1", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "tar.extract({\n\t\t\tcwd: destDir,\n\t\t\tstrip: 1, // Remove the top-level directory from the archive\n\t\t})", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC080", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|99abdff6c7547692faf8c3a56f084675b5d742fa64fbb7adbafa3807a28dacd1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/scripts/download-ripgrep.mjs"}, "region": {"startLine": 110}}}]}, {"ruleId": "SEC100", "level": "error", "message": {"text": "[SEC100] CORS permissive Access-Control-Allow-Origin: *: Permissive CORS policy (`*` origin) allows any website to make authenticated cross-origin requests. Especially dangerous when combined with `Access-Control-Allow-Credentials: true`."}, "properties": {"repobilityId": 79222, "scanner": "repobility-threat-engine", "fingerprint": "b3853ee86ce7f632ebf4d5def7d4e4a7a8c76bbc39305ea0eadcdca7c5c847f5", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "\"Access-Control-Allow-Origin\": \"*\"", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC100", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|b3853ee86ce7f632ebf4d5def7d4e4a7a8c76bbc39305ea0eadcdca7c5c847f5"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/examples/vscode/src/webview/vite.config.ts"}, "region": {"startLine": 18}}}]}, {"ruleId": "SEC100", "level": "error", "message": {"text": "[SEC100] CORS permissive Access-Control-Allow-Origin: *: Permissive CORS policy (`*` origin) allows any website to make authenticated cross-origin requests. Especially dangerous when combined with `Access-Control-Allow-Credentials: true`."}, "properties": {"repobilityId": 79221, "scanner": "repobility-threat-engine", "fingerprint": "9615646b77c28ddde5f4c7395909fb3f3fecfe1725ca6f9096128e7138459255", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "\"Access-Control-Allow-Origin\": \"*\"", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC100", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|9615646b77c28ddde5f4c7395909fb3f3fecfe1725ca6f9096128e7138459255"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cline-hub/src/webview/vite.config.ts"}, "region": {"startLine": 18}}}]}, {"ruleId": "SEC040", "level": "error", "message": {"text": "[SEC040] innerHTML XSS \u2014 template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflected XSS vector. The browser parses the HTML and executes any <script> or event-handler attributes in the data. CWE-79. Especially dangerous when the data comes from a CV parser, profile field, or any user-input pipeline."}, "properties": {"repobilityId": 79211, "scanner": "repobility-threat-engine", "fingerprint": "5a71f7f98185621dd701d5206b636df72d29514baf43efffec829a4cf7361fb7", "category": "xss", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "map(\n\t\t\t([theme, prefix]) => `\n${prefix} [data-chart=${id}] {\n${colorConfig\n\t.map(([key, itemConfig]", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC040", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|5a71f7f98185621dd701d5206b636df72d29514baf43efffec829a4cf7361fb7"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/examples/desktop-app/webview/components/ui/chart.tsx"}, "region": {"startLine": 82}}}]}, {"ruleId": "SEC040", "level": "error", "message": {"text": "[SEC040] innerHTML XSS \u2014 template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflected XSS vector. The browser parses the HTML and executes any <script> or event-handler attributes in the data. CWE-79. Especially dangerous when the data comes from a CV parser, profile field, or any user-input pipeline."}, "properties": {"repobilityId": 79210, "scanner": "repobility-threat-engine", "fingerprint": "542a620349e2ab7d75733084c416d8d7cb22837471a96c1c13ed298f22eff8bc", "category": "xss", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "map(\n\t\t\t\t\t\t([theme, prefix]) => `\n${prefix} [data-chart=${id}] {\n${colorConfig\n\t.map(([key, itemConf", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC040", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|542a620349e2ab7d75733084c416d8d7cb22837471a96c1c13ed298f22eff8bc"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cline-hub/src/webview/src/components/ui/chart.tsx"}, "region": {"startLine": 84}}}]}, {"ruleId": "SEC040", "level": "error", "message": {"text": "[SEC040] innerHTML XSS \u2014 template literal with server-supplied data: Setting .innerHTML with a template literal that interpolates server-supplied or user-supplied data is the canonical stored/reflected XSS vector. The browser parses the HTML and executes any <script> or event-handler attributes in the data. CWE-79. Especially dangerous when the data comes from a CV parser, profile field, or any user-input pipeline."}, "properties": {"repobilityId": 79209, "scanner": "repobility-threat-engine", "fingerprint": "b8bc13266fdf2dfa1cda64838e2f7f1a993b546f96a4493ee653db1318ed6c52", "category": "xss", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "map((tag) => `</${tag}", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC040", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|b8bc13266fdf2dfa1cda64838e2f7f1a993b546f96a4493ee653db1318ed6c52"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cline-hub/src/webview/src/components/ai-elements/jsx-preview.tsx"}, "region": {"startLine": 121}}}]}, {"ruleId": "SEC085", "level": "error", "message": {"text": "[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0)."}, "properties": {"repobilityId": 79197, "scanner": "repobility-threat-engine", "fingerprint": "c4be6ab904fff62e229010e4a78133f4dcf2b917a2af43e6363a56dab0bbbdd7", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "exec(line", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC085", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|c4be6ab904fff62e229010e4a78133f4dcf2b917a2af43e6363a56dab0bbbdd7"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/tui/utils/tool-parsing.ts"}, "region": {"startLine": 271}}}]}, {"ruleId": "SEC085", "level": "error", "message": {"text": "[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0)."}, "properties": {"repobilityId": 79196, "scanner": "repobility-threat-engine", "fingerprint": "228ecf63799b87a32fd0cb9b232703a9d146168d8535beee88588612523dd39f", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "exec(input", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC085", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|228ecf63799b87a32fd0cb9b232703a9d146168d8535beee88588612523dd39f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/tui/commands/slash-command-registry.ts"}, "region": {"startLine": 264}}}]}, {"ruleId": "SEC085", "level": "error", "message": {"text": "[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0)."}, "properties": {"repobilityId": 79195, "scanner": "repobility-threat-engine", "fingerprint": "1542c1707580815cd9cb78b2ef8c770688f10f2476e1612f52812c61f4bac4a9", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "exec(prompt", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC085", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|1542c1707580815cd9cb78b2ef8c770688f10f2476e1612f52812c61f4bac4a9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/runtime/prompt.ts"}, "region": {"startLine": 77}}}]}, {"ruleId": "SEC083", "level": "error", "message": {"text": "[SEC083] JS: new RegExp() with non-literal: new RegExp(<variable>) \u2014 variable input can craft a ReDoS pattern. Ported from eslint-plugin-security detect-non-literal-regexp (Apache-2.0)."}, "properties": {"repobilityId": 79193, "scanner": "repobility-threat-engine", "fingerprint": "a09666eda01ca1f3ea81dd3f22b818a4f56d48855b81c38c1356cfe4ebfa2bc6", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "new RegExp(regex", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC083", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|a09666eda01ca1f3ea81dd3f22b818a4f56d48855b81c38c1356cfe4ebfa2bc6"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/core/slash-commands/index.ts"}, "region": {"startLine": 113}}}]}, {"ruleId": "SEC083", "level": "error", "message": {"text": "[SEC083] JS: new RegExp() with non-literal: new RegExp(<variable>) \u2014 variable input can craft a ReDoS pattern. Ported from eslint-plugin-security detect-non-literal-regexp (Apache-2.0)."}, "properties": {"repobilityId": 79192, "scanner": "repobility-threat-engine", "fingerprint": "ee27323b5fd88d8a55595814aa835cbe6ba48e9cab9035e559532ab8a5b1be19", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "new RegExp(\n\t`${", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC083", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|ee27323b5fd88d8a55595814aa835cbe6ba48e9cab9035e559532ab8a5b1be19"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/tui/utils/image-paste.ts"}, "region": {"startLine": 18}}}]}, {"ruleId": "SEC083", "level": "error", "message": {"text": "[SEC083] JS: new RegExp() with non-literal: new RegExp(<variable>) \u2014 variable input can craft a ReDoS pattern. Ported from eslint-plugin-security detect-non-literal-regexp (Apache-2.0)."}, "properties": {"repobilityId": 79191, "scanner": "repobility-threat-engine", "fingerprint": "8383150cfe2f85eb6d0f4d046e8f1cc945e5740c783197745e234f0908530265", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "new RegExp(\n\tString", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC083", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|8383150cfe2f85eb6d0f4d046e8f1cc945e5740c783197745e234f0908530265"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/runtime/prompt.ts"}, "region": {"startLine": 54}}}]}, {"ruleId": "SEC128", "level": "error", "message": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work completes \u2014 DB writes lost, emails not sent, race conditions. This is one of the top-3 errors AI coders make: they understand async-shape but drop the await keyword when chaining multiple ops. Surfaces as flaky tests or silently dropped data in production."}, "properties": {"repobilityId": 79173, "scanner": "repobility-threat-engine", "fingerprint": "6cc2873792b407b20e069f46d1dcbfecf7ae5f06d2052e72fa303c352812903c", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "this.queues.delete(threadId);", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC128", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|6cc2873792b407b20e069f46d1dcbfecf7ae5f06d2052e72fa303c352812903c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/connectors/stores/memory-state.ts"}, "region": {"startLine": 23}}}]}, {"ruleId": "SEC128", "level": "error", "message": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work completes \u2014 DB writes lost, emails not sent, race conditions. This is one of the top-3 errors AI coders make: they understand async-shape but drop the await keyword when chaining multiple ops. Surfaces as flaky tests or silently dropped data in production."}, "properties": {"repobilityId": 79172, "scanner": "repobility-threat-engine", "fingerprint": "0484da69e68761a4e58b3ff79bfe073b101cdd6e7c5098c6d0441828aa2a27c2", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "this.persist();", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC128", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|0484da69e68761a4e58b3ff79bfe073b101cdd6e7c5098c6d0441828aa2a27c2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/connectors/stores/file-state.ts"}, "region": {"startLine": 133}}}]}, {"ruleId": "SEC128", "level": "error", "message": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work completes \u2014 DB writes lost, emails not sent, race conditions. This is one of the top-3 errors AI coders make: they understand async-shape but drop the await keyword when chaining multiple ops. Surfaces as flaky tests or silently dropped data in production."}, "properties": {"repobilityId": 79171, "scanner": "repobility-threat-engine", "fingerprint": "fdfb8deefa98d2a3877e083384c07bdbf07f492d66a94c18e2eecc19310a88c0", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "threadQueues.delete(threadId);", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC128", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|fdfb8deefa98d2a3877e083384c07bdbf07f492d66a94c18e2eecc19310a88c0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/connectors/chat-runtime.ts"}, "region": {"startLine": 37}}}]}, {"ruleId": "SEC033", "level": "error", "message": {"text": "[SEC033] Prototype Pollution \u2014 unfiltered merge of user object: Merging user-controlled object into a target without filtering `__proto__`/`constructor`/`prototype` keys lets attackers inject properties onto Object.prototype, affecting every object in the process. CWE-1321. Real-world: CVE-2019-10744 (lodash), CVE-2021-23337 (lodash.set), CVE-2023-26136 (tough-cookie)."}, "properties": {"repobilityId": 79170, "scanner": "repobility-threat-engine", "fingerprint": "b414faa14357a77b37651e9c5a77c2d63e25993eca5d4380575985aac71a2c65", "category": "prototype_pollution", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "[input.sessionId] =", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC033", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|b414faa14357a77b37651e9c5a77c2d63e25993eca5d4380575985aac71a2c65"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sdk/packages/core/src/session/services/file-session-service.ts"}, "region": {"startLine": 208}}}]}, {"ruleId": "SEC033", "level": "error", "message": {"text": "[SEC033] Prototype Pollution \u2014 unfiltered merge of user object: Merging user-controlled object into a target without filtering `__proto__`/`constructor`/`prototype` keys lets attackers inject properties onto Object.prototype, affecting every object in the process. CWE-1321. Real-world: CVE-2019-10744 (lodash), CVE-2021-23337 (lodash.set), CVE-2023-26136 (tough-cookie)."}, "properties": {"repobilityId": 79169, "scanner": "repobility-threat-engine", "fingerprint": "8291a1aa814e38939f28f75ba0939d25ab0cf07d745c630ed80a900fc4560ab8", "category": "prototype_pollution", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "[input.childEnvVar] =", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC033", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|8291a1aa814e38939f28f75ba0939d25ab0cf07d745c630ed80a900fc4560ab8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/connectors/base.ts"}, "region": {"startLine": 149}}}]}, {"ruleId": "MINED034", "level": "error", "message": {"text": "[MINED034] Python Subprocess Shell True: subprocess(..., shell=True) enables command injection."}, "properties": {"repobilityId": 79160, "scanner": "repobility-threat-engine", "fingerprint": "ad4c14330c80e2fb15521c4004ab52de0cf0ecdabccbef7fb88cd98956244581", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "python-subprocess-shell-true", "owasp": null, "cwe_ids": ["CWE-78"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347977+00:00", "triaged_in_corpus": 15, "observations_count": 3478, "ai_coder_pattern_id": 118}, "scanner": "repobility-threat-engine", "correlation_key": "fp|ad4c14330c80e2fb15521c4004ab52de0cf0ecdabccbef7fb88cd98956244581"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/coverage_check/util.py"}, "region": {"startLine": 190}}}]}, {"ruleId": "SEC078", "level": "error", "message": {"text": "[SEC078] Python: requests without timeout: requests.get/post without a timeout will hang indefinitely on a non-responsive server, causing thread exhaustion and ReDoS. Ported from bandit B113 (Apache-2.0). NOTE: this regex is heuristic; a real AST check is preferred for accuracy."}, "properties": {"repobilityId": 79154, "scanner": "repobility-threat-engine", "fingerprint": "b84440b95734c70781507241067ac3e78ced0ce4e5c35e03dce03600164bc9a3", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "requests.get(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC078", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|b84440b95734c70781507241067ac3e78ced0ce4e5c35e03dce03600164bc9a3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/coverage_check/github_api.py"}, "region": {"startLine": 123}}}]}, {"ruleId": "SEC029", "level": "error", "message": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes endpoints, file:// URIs), exfiltrate data, or pivot through your network. SSRF is OWASP A10:2021 and a frequent foothold in cloud breaches."}, "properties": {"repobilityId": 79152, "scanner": "repobility-threat-engine", "fingerprint": "2810af9715a9d9f6894e934e211b4003d8ca33d9c1deec037a42def042587f85", "category": "ssrf", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "URL(r", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC029", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|2810af9715a9d9f6894e934e211b4003d8ca33d9c1deec037a42def042587f85"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/connectors/chat-runtime.ts"}, "region": {"startLine": 81}}}]}, {"ruleId": "SEC029", "level": "error", "message": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes endpoints, file:// URIs), exfiltrate data, or pivot through your network. SSRF is OWASP A10:2021 and a frequent foothold in cloud breaches."}, "properties": {"repobilityId": 79151, "scanner": "repobility-threat-engine", "fingerprint": "2e58a87e6b19c884c6860cc27a6e972c82e1ae537f67f4465ac672cd7c738cb2", "category": "ssrf", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "Url(u", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC029", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|2e58a87e6b19c884c6860cc27a6e972c82e1ae537f67f4465ac672cd7c738cb2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/commands/dashboard.ts"}, "region": {"startLine": 128}}}]}, {"ruleId": "SEC029", "level": "error", "message": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes endpoints, file:// URIs), exfiltrate data, or pivot through your network. SSRF is OWASP A10:2021 and a frequent foothold in cloud breaches."}, "properties": {"repobilityId": 79150, "scanner": "repobility-threat-engine", "fingerprint": "272159a08085e062847d3ef47412c6932b41a898d6ffbac30a21d62dbcc31f42", "category": "ssrf", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "requests.get(comments_url", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC029", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|272159a08085e062847d3ef47412c6932b41a898d6ffbac30a21d62dbcc31f42"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/coverage_check/github_api.py"}, "region": {"startLine": 123}}}]}, {"ruleId": "SEC103", "level": "error", "message": {"text": "[SEC103] LDAP injection \u2014 non-constant search filter: User input concatenated into an LDAP search filter. Attackers inject `*)(uid=*` style payloads to bypass auth or enumerate accounts."}, "properties": {"repobilityId": 79149, "scanner": "repobility-threat-engine", "fingerprint": "548fd34742fd25926117eddea0588286105a9ad1ed93a9e3bde02cce8eaacf4e", "category": "injection", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": ".search(r'% Coverage report from v8.*?-+\\|.*?\\n.*?\\n(All files.*?)", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC103", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|injection|. token|49|sec103"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/coverage_check/extraction.py"}, "region": {"startLine": 49}}}]}, {"ruleId": "COMP001", "level": "error", "message": {"text": "[COMP001] High cognitive complexity: Function `extract_coverage` has cognitive complexity 27 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand \u2014 nested branches, boolean chains, and recursion all weigh in. Breakdown: else=4, except=2, for=2, if=8, nested_bonus=11."}, "properties": {"repobilityId": 79146, "scanner": "repobility-threat-engine", "fingerprint": "22db2a3d875d0e4f5e02c5c5bad3815fdd3388f9bdb159652cc7335e485e1025", "category": "quality", "severity": "high", "confidence": 0.95, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "AST-derived cognitive complexity score = 27 (severity threshold for high: 25+).", "evidence": {"scanner": "repobility-threat-engine", "function": "extract_coverage", "breakdown": {"if": 8, "for": 2, "else": 4, "except": 2, "nested_bonus": 11}, "complexity": 27, "correlation_key": "fp|22db2a3d875d0e4f5e02c5c5bad3815fdd3388f9bdb159652cc7335e485e1025"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/coverage_check/extraction.py"}, "region": {"startLine": 64}}}]}, {"ruleId": "MINED132", "level": "error", "message": {"text": "[MINED132] Reverse shell idiom: bash interactive shell to /dev/tcp: File contains a known reverse-shell pattern (bash interactive shell to /dev/tcp). These are almost never legitimate in production code \u2014 they're a hallmark of malicious payloads, post-exploit scripts, or CTF write-ups that accidentally got committed. Verify the file's provenance + history."}, "properties": {"repobilityId": 79369, "scanner": "repobility-supply-chain", "fingerprint": "e720b8b2429ef439b8e3d167ba7218f786dfabe58839e3785e3aa40674a7a6e7", "category": "dependency", "severity": "critical", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "reverse-shell-idiom", "owasp": null, "cwe_ids": ["CWE-78", "CWE-506"], "languages": ["any"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|e720b8b2429ef439b8e3d167ba7218f786dfabe58839e3785e3aa40674a7a6e7"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/core/permissions/CommandPermissionController.test.ts"}, "region": {"startLine": 963}}}]}, {"ruleId": "MINED116", "level": "error", "message": {"text": "[MINED116] Workflow uses `secrets.QLTY_COVERAGE_TOKEN` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.QLTY_COVERAGE_TOKEN }` lets a PR from any fork exfiltrate the secret (modify a script, log the value, etc.). Use `pull_request_target` ONLY with strict checkout discipline (no fork code in the trusted context)."}, "properties": {"repobilityId": 79368, "scanner": "repobility-supply-chain", "fingerprint": "52c9c6378bd9931d1af7c9be51ccb364c71153a9e6cfaa9165d849537c94afc7", "category": "dependency", "severity": "critical", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-pull-request-secrets", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|52c9c6378bd9931d1af7c9be51ccb364c71153a9e6cfaa9165d849537c94afc7"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ext-vscode-test.yml"}, "region": {"startLine": 363}}}]}, {"ruleId": "MINED116", "level": "error", "message": {"text": "[MINED116] Workflow uses `secrets.QLTY_COVERAGE_TOKEN` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.QLTY_COVERAGE_TOKEN }` lets a PR from any fork exfiltrate the secret (modify a script, log the value, etc.). Use `pull_request_target` ONLY with strict checkout discipline (no fork code in the trusted context)."}, "properties": {"repobilityId": 79367, "scanner": "repobility-supply-chain", "fingerprint": "4cdd24e2a274d0822bcb74ec9e1e73ff69b566a2ae46c5b2ed122ca8daeca8d4", "category": "dependency", "severity": "critical", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-pull-request-secrets", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|4cdd24e2a274d0822bcb74ec9e1e73ff69b566a2ae46c5b2ed122ca8daeca8d4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ext-vscode-test.yml"}, "region": {"startLine": 343}}}]}, {"ruleId": "MINED116", "level": "error", "message": {"text": "[MINED116] Workflow uses `secrets.QLTY_COVERAGE_TOKEN` on a `pull_request` trigger: This workflow triggers on `pull_request`, which checks out the FORK's code. Referencing `${ secrets.QLTY_COVERAGE_TOKEN }` lets a PR from any fork exfiltrate the secret (modify a script, log the value, etc.). Use `pull_request_target` ONLY with strict checkout discipline (no fork code in the trusted context)."}, "properties": {"repobilityId": 79366, "scanner": "repobility-supply-chain", "fingerprint": "1d3988c0b50763a3e912b3b1aca7d3a10eb830e95e771a45fab9065ef08b366c", "category": "dependency", "severity": "critical", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-pull-request-secrets", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|1d3988c0b50763a3e912b3b1aca7d3a10eb830e95e771a45fab9065ef08b366c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ext-vscode-test.yml"}, "region": {"startLine": 333}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "[MINED107] Missing import: `warnings` used but not imported: The file uses `warnings.something(...)` but never imports `warnings`. This raises NameError at runtime the first time the line executes."}, "properties": {"repobilityId": 79310, "scanner": "repobility-ast-engine", "fingerprint": "b405cb901723f0f268973c10e7bd6aea7c099f677a20162f3d37942213a2546d", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|b405cb901723f0f268973c10e7bd6aea7c099f677a20162f3d37942213a2546d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/scripts/coverage_check/workflow.py"}, "region": {"startLine": 226}}}]}, {"ruleId": "SEC084", "level": "error", "message": {"text": "[SEC084] JS: require() with non-literal: require(<variable>) loads arbitrary modules \u2014 equivalent to eval at module scope. Ported from eslint-plugin-security detect-non-literal-require (Apache-2.0)."}, "properties": {"repobilityId": 79271, "scanner": "repobility-threat-engine", "fingerprint": "a5d52a5ff0b6483e96c36fc8683f0557513d5a18e3165b7e85b68d40e18776b6", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "require(input", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC084", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|a5d52a5ff0b6483e96c36fc8683f0557513d5a18e3165b7e85b68d40e18776b6"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sdk/packages/core/src/services/llms/configured-provider-registry.ts"}, "region": {"startLine": 149}}}]}, {"ruleId": "MINED018", "level": "error", "message": {"text": "[MINED018] Unsafe Deserialization Pickle: pickle.loads / yaml.load (without Loader=SafeLoader) / unmarshal of network/file data \u2014 RCE."}, "properties": {"repobilityId": 79251, "scanner": "repobility-threat-engine", "fingerprint": "0e3312a0b035310b2b62c613ca5f32b83d0a6c87be6d9a11791320f3c6adfdef", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "unsafe-deserialization-pickle", "owasp": "A08:2021", "cwe_ids": ["CWE-502"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347940+00:00", "triaged_in_corpus": 20, "observations_count": 58759, "ai_coder_pattern_id": 32}, "scanner": "repobility-threat-engine", "correlation_key": "fp|0e3312a0b035310b2b62c613ca5f32b83d0a6c87be6d9a11791320f3c6adfdef"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "evals/analysis/src/classifier.ts"}, "region": {"startLine": 46}}}]}, {"ruleId": "MINED018", "level": "error", "message": {"text": "[MINED018] Unsafe Deserialization Pickle: pickle.loads / yaml.load (without Loader=SafeLoader) / unmarshal of network/file data \u2014 RCE."}, "properties": {"repobilityId": 79250, "scanner": "repobility-threat-engine", "fingerprint": "df144ba9c57b8ae68f50c2f0fee8eb04359699454f40995bf74c50a5db1500df", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "unsafe-deserialization-pickle", "owasp": "A08:2021", "cwe_ids": ["CWE-502"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347940+00:00", "triaged_in_corpus": 20, "observations_count": 58759, "ai_coder_pattern_id": 32}, "scanner": "repobility-threat-engine", "correlation_key": "fp|df144ba9c57b8ae68f50c2f0fee8eb04359699454f40995bf74c50a5db1500df"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/core/context/instructions/user-instructions/frontmatter.ts"}, "region": {"startLine": 47}}}]}, {"ruleId": "SEC116", "level": "error", "message": {"text": "[SEC116] Ruby YAML.load / Marshal.load on untrusted input: `YAML.load` (pre-3.1) and `Marshal.load` instantiate arbitrary Ruby classes \u2014 direct RCE on untrusted input. `unsafe_load` is even more dangerous."}, "properties": {"repobilityId": 79249, "scanner": "repobility-threat-engine", "fingerprint": "9fa71dfff4f23bbd545a163d48ec9fc158ac3ad811f1a2b9f2052ee57006b8f5", "category": "deserialization", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "yaml.load(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC116", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|deserialization|token|46|sec116"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "evals/analysis/src/classifier.ts"}, "region": {"startLine": 46}}}]}, {"ruleId": "SEC116", "level": "error", "message": {"text": "[SEC116] Ruby YAML.load / Marshal.load on untrusted input: `YAML.load` (pre-3.1) and `Marshal.load` instantiate arbitrary Ruby classes \u2014 direct RCE on untrusted input. `unsafe_load` is even more dangerous."}, "properties": {"repobilityId": 79248, "scanner": "repobility-threat-engine", "fingerprint": "55e4d3daafc2dc34873b1fa308fb3f49649e31c6fc2cf7ef68e8acde18db6806", "category": "deserialization", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "yaml.load(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC116", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|deserialization|token|47|sec116"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/core/context/instructions/user-instructions/frontmatter.ts"}, "region": {"startLine": 47}}}]}, {"ruleId": "SEC079", "level": "error", "message": {"text": "[SEC079] Python: yaml.load without SafeLoader: yaml.load() without explicit SafeLoader can execute arbitrary Python objects (CVE-2017-18342). Ported from bandit B506 / dlint DUO109 (Apache-2.0 / BSD-3)."}, "properties": {"repobilityId": 79247, "scanner": "repobility-threat-engine", "fingerprint": "65855ce795b1ff00948d9826506d3432583be39c6bdba48d00162b0c1a77f2a5", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "yaml.load(content, { schema: yaml.JSON_SCHEMA })", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC079", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|65855ce795b1ff00948d9826506d3432583be39c6bdba48d00162b0c1a77f2a5"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "evals/analysis/src/classifier.ts"}, "region": {"startLine": 46}}}]}, {"ruleId": "SEC079", "level": "error", "message": {"text": "[SEC079] Python: yaml.load without SafeLoader: yaml.load() without explicit SafeLoader can execute arbitrary Python objects (CVE-2017-18342). Ported from bandit B506 / dlint DUO109 (Apache-2.0 / BSD-3)."}, "properties": {"repobilityId": 79246, "scanner": "repobility-threat-engine", "fingerprint": "9fcd489cb2d5d930ee8a20443d94a130e3142e0a1ecb6937b02de8290e3a3f35", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "yaml.load(yamlContent, { schema: yaml.JSON_SCHEMA })", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC079", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|9fcd489cb2d5d930ee8a20443d94a130e3142e0a1ecb6937b02de8290e3a3f35"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/vscode/src/core/context/instructions/user-instructions/frontmatter.ts"}, "region": {"startLine": 47}}}]}]}]}